diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index b3e2e89214..32590fe4e9 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -10,9 +10,9 @@ description: This search looks for AWS CloudTrail events where a user A who has user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com - errorCode = success| search userIdentity.userName!=requestParameters.userName | stats count - min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src - eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId + errorCode = success| search userIdentity.userName!=requestParameters.userName | stats + count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName + src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_createaccesskey_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml index e1c5808134..fa75db346c 100644 --- a/detections/cloud/aws_createloginprofile.yml +++ b/detections/cloud/aws_createloginprofile.yml @@ -10,12 +10,13 @@ description: This search looks for AWS CloudTrail events where a user A(victim A B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip search: '`cloudtrail` eventName = CreateLoginProfile | rename requestParameters.userName - as new_login_profile | table src_ip eventName new_login_profile userIdentity.userName | join - new_login_profile src_ip [| search `cloudtrail` eventName = ConsoleLogin | rename - userIdentity.userName as new_login_profile | stats count values(eventName) min(_time) as firstTime - max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID - awsRegion userIdentity.principalId user_arn new_login_profile src_ip | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`] | `aws_createloginprofile_filter`' + as new_login_profile | table src_ip eventName new_login_profile userIdentity.userName | + join new_login_profile src_ip [| search `cloudtrail` eventName = ConsoleLogin | + rename userIdentity.userName as new_login_profile | stats count values(eventName) + min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode + userAgent eventID awsRegion userIdentity.principalId user_arn new_login_profile + src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`] + | `aws_createloginprofile_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. known_false_positives: While this search has no known false positives, it is possible diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index f12837d6ae..ca9d041d8c 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -10,9 +10,9 @@ description: This search looks for AWS CloudTrail events where a user A who has another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) search: '`cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com - errorCode = success| search userIdentity.userName!=requestParameters.userName | stats count - min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src - eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName + errorCode = success| search userIdentity.userName!=requestParameters.userName | stats + count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName + src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml index 6888b28af4..13cc222530 100644 --- a/detections/cloud/detect_new_open_s3_buckets.yml +++ b/detections/cloud/detect_new_open_s3_buckets.yml @@ -13,8 +13,8 @@ search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime - max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent uri permission - bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent + uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` ' how_to_implement: You must install the AWS App for Splunk. known_false_positives: While this search has no known false positives, it is possible diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index 52bebea07a..d2ce13b87e 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -33,12 +33,31 @@ tags: analytic_story: - Trickbot automated_detection_testing: passed + confidence: 50 + context: + - Source:Endpoint + - Stage:Discovery dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + impact: 10 kill_chain_phases: - Reconnaissance + message: Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$. mitre_attack_id: - T1087.002 + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: process_name + type: Process Name + role: + - Process product: - Splunk Enterprise - Splunk Enterprise Security @@ -53,25 +72,5 @@ tags: - Processes.process_guid - Processes.dest - Processes.user - security_domain: endpoint - impact: 10 - confidence: 50 - # (impact * confidence)/100 risk_score: 5 - context: - - Source:Endpoint - - Stage:Discovery - message: Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: process_name - type: Process Name - role: - - Process \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index e1d432f72c..ad9ac932ff 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -8,8 +8,8 @@ datamodel: - Endpoint description: This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This - technique was identified when an adversary wants to grant remote access to a machine by - allowing the traffic in a firewall rule. + technique was identified when an adversary wants to grant remote access to a machine + by allowing the traffic in a firewall rule. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name = @@ -29,12 +29,28 @@ tags: analytic_story: - Prohibited Traffic Allowed or Protocol Mismatch automated_detection_testing: passed + confidence: 30 + context: + - Source:Endpoint + - Stage:Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + impact: 10 kill_chain_phases: - Exploitation + message: Suspicious firewall modifications were detected via the registry on endpoint + $dest$ by user $user$. mitre_attack_id: - T1021.001 + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -46,21 +62,5 @@ tags: - Registry.registry_key_name - Registry.dest - Registry.user - security_domain: endpoint - impact: 10 - confidence: 30 - # (impact * confidence)/100 risk_score: 3 - context: - - Source:Endpoint - - Stage:Lateral Movement - message: Suspicious firewall modifications were detected via the registry on endpoint $dest$ by user $user$. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim + security_domain: endpoint diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml index c79acb9f28..d88570e168 100644 --- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml +++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml @@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: The following analytic identifies suspicious PowerShell command to allow inbound - traffic inbound to a specific local port within the public profile. This technique was seen in some - attacker want to have a remote access to a machine by allowing the traffic in firewall - rule. +description: The following analytic identifies suspicious PowerShell command to allow + inbound traffic inbound to a specific local port within the public profile. This + technique was seen in some attacker want to have a remote access to a machine by + allowing the traffic in firewall rule. search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message = "*Inbound*" Message = "*Allow*" Message = "*-LocalPort*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` @@ -25,12 +25,28 @@ tags: analytic_story: - Prohibited Traffic Allowed or Protocol Mismatch automated_detection_testing: passed + confidence: 30 + context: + - Source:Endpoint + - Stage:Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log + impact: 10 kill_chain_phases: - Exploitation + message: Suspicious firewall modification detected on endpoint $ComputerName$ by + user $user$. mitre_attack_id: - T1021.001 + observable: + - name: user + type: User + role: + - Victim + - name: ComputerName + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -41,21 +57,5 @@ tags: - Message - ComputerName - User - security_domain: endpoint - impact: 10 - confidence: 30 - # (impact * confidence)/100 risk_score: 3 - context: - - Source:Endpoint - - Stage:Lateral Movement - message: Suspicious firewall modification detected on endpoint $ComputerName$ by user $user$. - observable: - - name: user - type: User - role: - - Victim - - name: ComputerName - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml index 4045e2272a..93c345aebb 100644 --- a/detections/endpoint/allow_network_discovery_in_firewall.yml +++ b/detections/endpoint/allow_network_discovery_in_firewall.yml @@ -48,7 +48,7 @@ tags: - Processes.process_name - Processes.process - Processes.process_id - - Processes.parent_process + - Processes.parent_process - Processes.parent_process_id - Processes.parent_process_name security_domain: endpoint diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index b1b4570d80..405f810f46 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -31,12 +31,28 @@ tags: analytic_story: - Ransomware automated_detection_testing: passed + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log + impact: 50 kill_chain_phases: - Exploitation + message: Suspicious registry modification was performed on endpoint $dest$ by user + $user$. This behavior is indicative of privilege escalation. mitre_attack_id: - T1548 + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -47,21 +63,5 @@ tags: - Registry.registry_key_name - Registry.registry_value_name - Registry.dest - security_domain: endpoint - impact: 50 - confidence: 50 - # (impact * confidence)/100 risk_score: 25 - context: - - Source:Endpoint - - Stage:Privilege Escalation - message: Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim + security_domain: endpoint diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml index 775ad9c6ee..e00c48e276 100644 --- a/detections/endpoint/anomalous_usage_of_7zip.yml +++ b/detections/endpoint/anomalous_usage_of_7zip.yml @@ -33,36 +33,20 @@ tags: - Cobalt Strike - NOBELIUM Group automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log - kill_chain_phases: - - Actions on Objective - mitre_attack_id: - - T1560.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.parent_process - - Processes.process_id - - Processes.parent_process_id - security_domain: endpoint - impact: 80 confidence: 80 - # (impact * confidence)/100 - risk_score: 64 context: - Source:Endpoint - Stage:Collection - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + impact: 80 + kill_chain_phases: + - Actions on Objective + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading + of 7zip. + mitre_attack_id: + - T1560.001 observable: - name: user type: User @@ -79,4 +63,21 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id + risk_score: 64 + security_domain: endpoint diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index 70a92c57b3..fb300e8bdd 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -32,36 +32,20 @@ tags: analytic_story: - Malicious PowerShell - Ingress Tool Transfer - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1059.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.parent_process - - Processes.process_id - - Processes.parent_process_id - security_domain: endpoint - impact: 80 confidence: 70 - # (impact * confidence)/100 - risk_score: 56 context: - Source:Endpoint - Stage:Exploitation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile + within PowerShell. + mitre_attack_id: + - T1059.001 observable: - name: user type: User @@ -78,4 +62,21 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id + risk_score: 56 + security_domain: endpoint diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index c36455993b..4c29d3578f 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -34,33 +34,17 @@ tags: - HAFNIUM Group - Ingress Tool Transfer automated_detection_testing: passed + confidence: 70 dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString + within PowerShell. mitre_attack_id: - T1059.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.parent_process - - Processes.process_id - - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 70 - # (impact * confidence)/100 - risk_score: 56 - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString within PowerShell. observable: - name: user type: User @@ -77,4 +61,21 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id + risk_score: 56 + security_domain: endpoint diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index 570229095c..e074c4bbea 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -34,12 +34,21 @@ tags: automated_detection_testing: passed cis20: - CIS 2 + confidence: 80 + context: + - Source:Endpoint + - Stage:Exploitation + - Stage:Recon + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log + impact: 80 kill_chain_phases: - Installation - Command and Control - Actions on Objectives + message: An attacker tool $process_name$,listed in attacker_tools.csv is executed + on host $dest$ by User $user$. This process $process_name$ is known to do- $description$ mitre_attack_id: - T1036.005 - T1595 @@ -47,29 +56,6 @@ tags: nist: - ID.AM - PR.DS - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - Processes.dest - - Processes.user - - Processes.process_name - - Processes.parent_process - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log - security_domain: endpoint - impact: 80 - confidence: 80 - # (impact * confidence)/100 - risk_score: 64 - context: - - Source:Endpoint - - Stage:Exploitation - - Stage:Recon - - Stage:Execution - message: An attacker tool $process_name$,listed in attacker_tools.csv is executed on host $dest$ by User $user$. This process $process_name$ is known to do- $description$ observable: - name: user type: User @@ -88,3 +74,14 @@ tags: role: - Child Process - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - Processes.dest + - Processes.user + - Processes.process_name + - Processes.parent_process + risk_score: 64 + security_domain: endpoint diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index a4cd16deff..08f1f3fc8c 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -9,9 +9,10 @@ datamodel: description: Attempt To Add Certificate To Untrusted Store search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil* - (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `attempt_to_add_certificate_to_untrusted_store_filter`' + (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` + | `attempt_to_add_certificate_to_untrusted_store_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. @@ -20,8 +21,8 @@ how_to_implement: You must be ingesting data that records process activity from known_false_positives: There may be legitimate reasons for administrators to add a certificate to the untrusted certificate store. In such cases, this will typically be done on a large number of systems. -references: - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md tags: analytic_story: - Disabling Security Tools @@ -31,40 +32,24 @@ tags: - CIS 3 - CIS 5 - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.004/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Installation - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + attempting to add a certificate to the store on endpoint $dest$ by user $user$. mitre_attack_id: - T1553.004 nist: - PR.PT - DE.CM - PR.IP - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.parent_process - - Processes.process_id - - Processes.parent_process_id - security_domain: endpoint - impact: 70 - confidence: 50 - # (impact * confidence)/100 - risk_score: 35 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to add a certificate to the store on endpoint $dest$ by user $user$. observable: - name: user type: User @@ -81,4 +66,20 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id + risk_score: 35 + security_domain: endpoint diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index a877bff6ad..dcac0b6abf 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -12,10 +12,10 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = net.exe OR Processes.process_name = sc.exe) Processes.process="* stop *" by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - |lookup security_services_lookup service as process OUTPUTNEW category, description - | search category=security | `attempt_to_stop_security_service_filter`' + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |lookup + security_services_lookup service as process OUTPUTNEW category, description | search + category=security | `attempt_to_stop_security_service_filter`' how_to_implement: You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which @@ -28,8 +28,8 @@ how_to_implement: You must be ingesting data that records the file-system activi services you would like to monitor for attempts to stop the service., known_false_positives: None identified. Attempts to disable security-related services should be identified and understood. -references: - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service tags: analytic_story: - Disabling Security Tools @@ -40,39 +40,24 @@ tags: - CIS 3 - CIS 5 - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log + impact: 40 kill_chain_phases: - Installation - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + attempting to disable security services on endpoint $dest$ by user $user$. mitre_attack_id: - T1562.001 nist: - PR.PT - DE.CM - PR.IP - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - security_domain: endpoint - impact: 40 - confidence: 50 - # (impact * confidence)/100 - risk_score: 20 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. observable: - name: user type: User @@ -89,4 +74,19 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 20 + security_domain: endpoint diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index b2496aee91..1795c2cf15 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -13,16 +13,16 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `attempted_credential_dump_from_registry_via_reg_exe_filter`' + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`' how_to_implement: You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. known_false_positives: None identified. -references: - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets tags: analytic_story: - Credential Dumping @@ -33,36 +33,21 @@ tags: - CIS 3 - CIS 5 - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to export the registry keys. mitre_attack_id: - T1003.002 nist: - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - security_domain: endpoint - impact: 90 - confidence: 100 - # (impact * confidence)/100 - risk_score: 90 - context: - - Source:Endpoint - - Stage:Credential Access - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. observable: - name: user type: User @@ -79,4 +64,19 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 90 + security_domain: endpoint diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index 31e1684ef1..53800654b2 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -33,34 +33,22 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 90 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon.log + impact: 70 kill_chain_phases: - Delivery + message: A file - $file_name$ was written to system32 has occurred on endpoint $dest$ + by user $user$. mitre_attack_id: - T1204.002 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Filesystem.dest - - Filesystem.file_name - - Filesystem.user - - Filesystem.file_path - security_domain: endpoint - impact: 70 - confidence: 90 - # (impact * confidence)/100 - risk_score: 63 - context: - - Source:Endpoint - - Stage:Execution - message: A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$. observable: - name: user type: User @@ -73,4 +61,16 @@ tags: - name: file_name type: File Name role: - - Victim \ No newline at end of file + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_name + - Filesystem.user + - Filesystem.file_path + risk_score: 63 + security_domain: endpoint diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index 957fc2aa21..b61330e800 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -20,7 +20,7 @@ how_to_implement: You must be ingesting endpoint data that tracks process activi data model in the Processes node. Tune based on parent process names. known_false_positives: Administrators may modify the boot configuration. references: - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair tags: analytic_story: - Ryuk Ransomware @@ -29,34 +29,22 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 80 + context: + - Source:Endpoint + - Stage:Impact dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + impact: 100 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting disable the ability to recover the + endpoint. mitre_attack_id: - T1490 nist: - PR.IP - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.process_name - - Processes.process - - Processes.parent_process_name - - Processes.dest - - Processes.user - security_domain: endpoint - impact: 100 - confidence: 80 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Impact - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting disable the ability to recover the endpoint. observable: - name: user type: User @@ -73,4 +61,17 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.dest + - Processes.user + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index 69a802660c..64846429aa 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -35,38 +35,19 @@ tags: analytic_story: - BITS Jobs automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1197 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 70 confidence: 80 - # (impact * confidence)/100 - risk_score: 56 context: - Source:Endpoint - Stage:Persistence - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to persist using BITS. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to persist using BITS. + mitre_attack_id: + - T1197 observable: - name: user type: User @@ -83,4 +64,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 56 + security_domain: endpoint diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index 5be9015d27..498b883a2a 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -40,39 +40,20 @@ tags: - BITS Jobs - DarkSide Ransomware automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1197 - - T1105 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 70 confidence: 70 - # (impact * confidence)/100 - risk_score: 49 context: - Source:Endpoint - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to download a file. + mitre_attack_id: + - T1197 + - T1105 observable: - name: user type: User @@ -89,4 +70,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml index fa1c083fac..59853291cd 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml @@ -33,38 +33,19 @@ tags: - Ingress Tool Transfer - DarkSide Ransomware automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1105 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 90 confidence: 100 - # (impact * confidence)/100 - risk_score: 90 context: - Source:Endpoint - Stage:Command and Control - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log + impact: 90 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to download a file. + mitre_attack_id: + - T1105 observable: - name: user type: User @@ -81,4 +62,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 90 + security_domain: endpoint diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml index ac7b9ec12c..40b28f1a00 100644 --- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml @@ -34,38 +34,19 @@ tags: - Ingress Tool Transfer - DarkSide Ransomware automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1105 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 90 confidence: 100 - # (impact * confidence)/100 - risk_score: 90 context: - Source:Endpoint - Stage:Command and Control - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log + impact: 90 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to download a file. + mitre_attack_id: + - T1105 observable: - name: user type: User @@ -82,4 +63,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 90 + security_domain: endpoint diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index d6211c930b..e95e5d8091 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -11,9 +11,10 @@ description: This search looks for arguments to certutil.exe indicating the mani tokens specially inside Federated environments such as Windows ADFS. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe - Processes.process = "* -exportPFX *" Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter`' + Processes.process = "* -exportPFX *" Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id| + `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` + | `certutil_exe_certificate_extraction_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -27,36 +28,17 @@ tags: - Cloud Federated Credential Abuse asset_type: Endpoint automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log - kill_chain_phases: - - Installation - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 90 confidence: 70 - # (impact * confidence)/100 - risk_score: 63 context: - Source:Endpoint - Stage:Privilege Escalation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log + impact: 90 + kill_chain_phases: + - Installation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting export a certificate. observable: - name: user type: User @@ -73,4 +55,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 63 + security_domain: endpoint diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index ebc556ff92..bd098c6f68 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -35,38 +35,19 @@ tags: analytic_story: - Deobfuscate-Decode Files or Information automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/windows-sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1140 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 50 confidence: 80 - # (impact * confidence)/100 - risk_score: 40 context: - Source:Endpoint - Stage:Execution - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/windows-sysmon.log + impact: 50 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to decode a file. + mitre_attack_id: + - T1140 observable: - name: user type: User @@ -83,4 +64,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 40 + security_domain: endpoint diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml index db8ecf36e0..1b9642efc1 100644 --- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml +++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml @@ -20,44 +20,26 @@ how_to_implement: To successfully implement this search you need to be ingesting your endpoints into the `Endpoint` datamodel in the `Processes` node. known_false_positives: administrator may execute this app to manage disk references: - - https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/ - - https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf +- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/ +- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf tags: analytic_story: - Ransomware automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1070.004 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 100 confidence: 90 - # (impact * confidence)/100 - risk_score: 90 context: - Source:Endpoint - Stage:Impact - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log + impact: 100 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors + of a specific disk. + mitre_attack_id: + - T1070.004 observable: - name: user type: User @@ -75,3 +57,22 @@ tags: type: Process role: - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 90 + security_domain: endpoint diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml index caebf8ad6f..8cffff4c94 100644 --- a/detections/endpoint/clop_common_exec_parameter.yml +++ b/detections/endpoint/clop_common_exec_parameter.yml @@ -18,7 +18,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name != "*temp.dat*" Processes.process = "*runrun*" OR Processes.process = "*temp.dat*" by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -31,38 +31,20 @@ tags: analytic_story: - Clop Ransomware automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_b/windows-sysmon.log - kill_chain_phases: - - Obfuscation - mitre_attack_id: - - T1204 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 100 confidence: 100 - # (impact * confidence)/100 - risk_score: 100 context: - Source:Endpoint - Stage:Execution - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting using arguments to execute its main code or feature of its code related to Clop ransomware. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_b/windows-sysmon.log + impact: 100 + kill_chain_phases: + - Obfuscation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting using arguments to execute its main + code or feature of its code related to Clop ransomware. + mitre_attack_id: + - T1204 observable: - name: user type: User @@ -79,4 +61,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 100 + security_domain: endpoint diff --git a/detections/endpoint/clop_ransomware_known_service_name.yml b/detections/endpoint/clop_ransomware_known_service_name.yml index 8924772b76..f1b80e7c1b 100644 --- a/detections/endpoint/clop_ransomware_known_service_name.yml +++ b/detections/endpoint/clop_ransomware_known_service_name.yml @@ -25,33 +25,19 @@ tags: analytic_story: - Clop Ransomware automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log - kill_chain_phases: - - Privilege Escalation - mitre_attack_id: - - T1543 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - EventCode - - cmdline - - _time - - parent_process_name - - process_name - - OriginalFileName - - process_path - security_domain: endpoint - impact: 100 confidence: 100 - # (impact * confidence)/100 - risk_score: 100 context: - Source:Endpoint - Stage:Privilege Escalation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ executing known Clop Ransomware service names. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log + impact: 100 + kill_chain_phases: + - Privilege Escalation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ executing known Clop Ransomware service names. + mitre_attack_id: + - T1543 observable: - name: user type: User @@ -68,4 +54,18 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - EventCode + - cmdline + - _time + - parent_process_name + - process_name + - OriginalFileName + - process_path + risk_score: 100 + security_domain: endpoint diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml index 88ed1346a3..09fa9f9cdb 100644 --- a/detections/endpoint/cmd_echo_pipe___escalation.yml +++ b/detections/endpoint/cmd_echo_pipe___escalation.yml @@ -28,40 +28,22 @@ tags: analytic_story: - Cobalt Strike automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log - kill_chain_phases: - - Exploitation - - Privilege Escalation - mitre_attack_id: - - T1059.003 - - T1543.003 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 80 confidence: 80 - # (impact * confidence)/100 - risk_score: 64 context: - Source:Endpoint - Stage:Privilege Escalation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + - Privilege Escalation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ potentially performing privilege escalation + using named pipes related to Cobalt Strike and other frameworks. + mitre_attack_id: + - T1059.003 + - T1543.003 observable: - name: user type: User @@ -78,4 +60,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 64 + security_domain: endpoint diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index 69f9f39c6b..fa4c4a83fd 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -26,12 +26,32 @@ tags: - DarkSide Ransomware - Ransomware automated_detection_testing: passed + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon.log + impact: 80 kill_chain_phases: - Exploitation + message: The following module $ImageLoaded$ was loaded by a non-standard application + on endpoint $Computer$ by user $user$. mitre_attack_id: - T1218.003 + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: ImageLoaded + type: Other + role: + - Other product: - Splunk Enterprise - Splunk Enterprise Security @@ -45,25 +65,5 @@ tags: - EventCode - Signed - ProcessId - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$. - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: ImageLoaded - type: Other - role: - - Other \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml index e474099af8..c3c52763c0 100644 --- a/detections/endpoint/cobalt_strike_named_pipes.yml +++ b/detections/endpoint/cobalt_strike_named_pipes.yml @@ -46,36 +46,22 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 90 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: An instance of $process_name$ was identified on endpoint $Computer$ by + user $user$ accessing known suspicious named pipes related to Cobalt Strike. mitre_attack_id: - T1055 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventID - - PipeName - - Computer - - process_name - - process_path - - process_id - security_domain: endpoint - impact: 80 - confidence: 90 - # (impact * confidence)/100 - risk_score: 72 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $process_name$ was identified on endpoint $Computer$ by user $user$ accessing known suspicious named pipes related to Cobalt Strike. observable: - name: user type: User @@ -88,4 +74,18 @@ tags: - name: process_name type: Process role: - - Parent Process \ No newline at end of file + - Parent Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventID + - PipeName + - Computer + - process_name + - process_path + - process_id + risk_score: 72 + security_domain: endpoint diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 2e47ea7e10..7fbd72d652 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -36,6 +36,7 @@ known_false_positives: It is possible for a legitimate file with these extension of files created with these extensions. references: [] tags: + Consequence: Data Destruction analytic_story: - SamSam Ransomware - Ryuk Ransomware @@ -45,35 +46,23 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_extensions/windows-sysmon.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, + this is indicative of a known ransomware file extension and should be reviewed + immediately. mitre_attack_id: - T1485 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Filesystem.user - - Filesystem.dest - - Filesystem.file_path - - Filesystem.file_name - security_domain: endpoint - impact: 90 - confidence: 100 - # (impact * confidence)/100 - risk_score: 90 - context: - - Source:Endpoint - - Stage:Execution - Consequence: Data Destruction - message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware file extension and should be reviewed immediately. observable: - name: user type: User @@ -86,4 +75,16 @@ tags: - name: file_name type: File Name role: - - Victim \ No newline at end of file + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.user + - Filesystem.dest + - Filesystem.file_path + - Filesystem.file_name + risk_score: 90 + security_domain: endpoint diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index e7a3b33a00..7fa1a1fc5f 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -22,6 +22,7 @@ known_false_positives: It's possible that a legitimate file could be created wit the same name used by ransomware note files. references: [] tags: + Consequence: Data Destruction analytic_story: - SamSam Ransomware - Ransomware @@ -31,35 +32,22 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_notes/windows-sysmon.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, + this is indicative of a known ransomware note file and should be reviewed immediately. mitre_attack_id: - T1485 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Filesystem.user - - Filesystem.dest - - Filesystem.file_path - - Filesystem.file_name - security_domain: endpoint - impact: 90 - confidence: 100 - # (impact * confidence)/100 - risk_score: 90 - context: - - Source:Endpoint - - Stage:Execution - Consequence: Data Destruction - message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware note file and should be reviewed immediately. observable: - name: user type: User @@ -72,4 +60,16 @@ tags: - name: file_name type: File Name role: - - Victim \ No newline at end of file + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.user + - Filesystem.dest + - Filesystem.file_path + - Filesystem.file_name + risk_score: 90 + security_domain: endpoint diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index 0c39677dc5..548d569fa2 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -28,38 +28,20 @@ tags: analytic_story: - Ransomware automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1204 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 80 confidence: 80 - # (impact * confidence)/100 - risk_score: 64 context: - Source:Endpoint - Stage:Execution - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ executing specific Conti Ransomware related + parameters. + mitre_attack_id: + - T1204 observable: - name: user type: User @@ -76,4 +58,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 64 + security_domain: endpoint diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index 82ccb48ef1..877b912c75 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -29,43 +29,25 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 60 + context: + - Source:Endpoint + - Stage:Persistence dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log + impact: 50 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators + group. mitre_attack_id: - T1136.001 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 50 - confidence: 60 - # (impact * confidence)/100 - risk_score: 30 - context: - - Source:Endpoint - - Stage:Persistence - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group. observable: - name: user type: User @@ -82,4 +64,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 30 + security_domain: endpoint diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index a4113ec5e3..df3ca08a4a 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -30,41 +30,22 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Discovery dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.005/atomic_red_team/windows-sysmon.log + impact: 50 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ enumerating Windows file shares. mitre_attack_id: - T1070.005 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 50 - confidence: 50 - # (impact * confidence)/100 - risk_score: 25 - context: - - Source:Endpoint - - Stage:Discovery - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares. observable: - name: user type: User @@ -81,4 +62,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 25 + security_domain: endpoint diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index 26829c725e..6ca195cb73 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -28,14 +28,30 @@ tags: cis20: - CIS 8 - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: A process has created a remote thread into $TargetImage$ on $dest$. This + behavior is indicative of credential dumping and should be investigated. mitre_attack_id: - T1003.001 nist: - DE.CM + observable: + - name: TargetImage + type: Other + role: + - Other + - name: dest + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -49,21 +65,5 @@ tags: - TargetImage - TargetProcessId - dest - security_domain: endpoint - impact: 90 - confidence: 90 - # (impact * confidence)/100 risk_score: 81 - context: - - Source:Endpoint - - Stage:Credential Access - message: A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated. - observable: - - name: TargetImage - type: Other - role: - - Other - - name: dest - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/create_service_in_suspicious_file_path.yml b/detections/endpoint/create_service_in_suspicious_file_path.yml index 38e78ee390..1fe70c6402 100644 --- a/detections/endpoint/create_service_in_suspicious_file_path.yml +++ b/detections/endpoint/create_service_in_suspicious_file_path.yml @@ -24,12 +24,28 @@ tags: analytic_story: - Clop Ransomware automated_detection_testing: passed + confidence: 80 + context: + - Source:Endpoint + - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log + impact: 70 kill_chain_phases: - Privilege Escalation + message: A service $Service_File_Name$ was created from a non-standard path using + $Service_Name$, potentially leading to a privilege escalation. mitre_attack_id: - T1569.002 + observable: + - name: Service_File_Name + type: Other + role: + - Other + - name: Service_Name + type: Other + role: + - Other product: - Splunk Enterprise - Splunk Enterprise Security @@ -41,21 +57,5 @@ tags: - _time - Service_Name - Service_Start_Type - security_domain: endpoint - impact: 70 - confidence: 80 - # (impact * confidence)/100 risk_score: 56 - context: - - Source:Endpoint - - Stage:Privilege Escalation - message: A service $Service_File_Name$ was created from a non-standard path using $Service_Name$, potentially leading to a privilege escalation. - observable: - - name: Service_File_Name - type: Other - role: - - Other - - name: Service_Name - type: Other - role: - - Other \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index 5aafcb0286..5a74fcf6ac 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -34,34 +34,21 @@ tags: cis20: - CIS 6 - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ + to disk. This behavior is related to dumping credentials via Task Manager. mitre_attack_id: - T1003.001 nist: - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventID - - process_name - - TargetFilename - - Computer - - object_category - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Credential Access - message: $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. observable: - name: user type: User @@ -78,4 +65,17 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventID + - process_name + - TargetFilename + - Computer + - object_category + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 732098f893..c76efbdcaa 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -31,40 +31,22 @@ tags: cis20: - CIS 8 - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform + offline password cracking. mitre_attack_id: - T1003.003 nist: - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 90 - confidence: 90 - # (impact * confidence)/100 - risk_score: 81 - context: - - Source:Endpoint - - Stage:Credential Access - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. observable: - name: user type: User @@ -82,3 +64,22 @@ tags: type: Process role: - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 81 + security_domain: endpoint diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index eda44bfe58..6eb5bb22fb 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -27,40 +27,22 @@ tags: cis20: - CIS 8 - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform + offline password cracking. mitre_attack_id: - T1003.003 nist: - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 90 - confidence: 90 - # (impact * confidence)/100 - risk_score: 81 - context: - - Source:Endpoint - - Stage:Credential Access - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. observable: - name: user type: User @@ -77,4 +59,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 81 + security_domain: endpoint diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index 559ce7e521..627816641f 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -30,40 +30,22 @@ tags: cis20: - CIS 8 - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline + password cracking. mitre_attack_id: - T1003.003 nist: - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 90 - confidence: 90 - # (impact * confidence)/100 - risk_score: 81 - context: - - Source:Endpoint - - Stage:Credential Access - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking. observable: - name: user type: User @@ -80,4 +62,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 81 + security_domain: endpoint diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index 9b6128ea60..741d143c4f 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -28,40 +28,22 @@ tags: cis20: - CIS 8 - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy + to grab credentials. mitre_attack_id: - T1003.003 nist: - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 90 - confidence: 90 - # (impact * confidence)/100 - risk_score: 81 - context: - - Source:Endpoint - - Stage:Credential Access - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials. observable: - name: user type: User @@ -78,4 +60,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 81 + security_domain: endpoint diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index 427eec0522..a0b2c326aa 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -28,12 +28,28 @@ tags: - Ransomware - Revil Ransomware automated_detection_testing: passed + confidence: 90 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log + impact: 90 kill_chain_phases: - Exploitation + message: An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$ + by $User$. mitre_attack_id: - T1490 + observable: + - name: User + type: User + role: + - Victim + - name: ComputerName + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -44,21 +60,5 @@ tags: - Message - ComputerName - User - security_domain: endpoint - impact: 90 - confidence: 90 - # (impact * confidence)/100 risk_score: 81 - context: - - Source:Endpoint - - Stage:Execution - message: An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$ by $User$. - observable: - - name: User - type: User - role: - - Victim - - name: ComputerName - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml index 01c56b9ca1..a17a4b1e62 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/endpoint/deleting_of_net_users.yml @@ -31,38 +31,19 @@ tags: analytic_story: - XMRig automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1531 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 50 confidence: 50 - # (impact * confidence)/100 - risk_score: 25 context: - Source:Endpoint - Stage:Persistence - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete accounts. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + impact: 50 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to delete accounts. + mitre_attack_id: + - T1531 observable: - name: user type: User @@ -79,4 +60,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 25 + security_domain: endpoint diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index aa60567897..8387662c1c 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -35,42 +35,23 @@ tags: cis20: - CIS 8 - CIS 10 + confidence: 90 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to delete shadow copies. mitre_attack_id: - T1490 nist: - PR.PT - DE.CM - PR.IP - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 90 - confidence: 90 - # (impact * confidence)/100 - risk_score: 81 - context: - - Source:Endpoint - - Stage:Execution - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies. observable: - name: user type: User @@ -87,4 +68,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 81 + security_domain: endpoint diff --git a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml index 7b2aedb501..7d17c1b22c 100644 --- a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml +++ b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml @@ -26,10 +26,17 @@ tags: - CIS 3 - CIS 5 - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Lateral Movement dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/atomic_red_team/windows-security.log + impact: 70 kill_chain_phases: - Actions on Objectives + message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type + 3, which may be indicative of the pass the hash technique. mitre_attack_id: - T1550.002 nist: @@ -37,27 +44,6 @@ tags: - PR.AT - PR.AC - PR.IP - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventCode - - Logon_Type - - Logon_Process - - WorkstationName - - user - - dest - security_domain: access - impact: 70 - confidence: 70 - # (impact * confidence)/100 - risk_score: 49 - context: - - Source:Endpoint - - Stage:Lateral Movement - message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the pass the hash technique. observable: - name: user type: User @@ -70,4 +56,18 @@ tags: - name: EventCode type: Other role: - - Other \ No newline at end of file + - Other + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Logon_Type + - Logon_Process + - WorkstationName + - user + - dest + risk_score: 49 + security_domain: access diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml index b09603c10f..2efbb38026 100644 --- a/detections/endpoint/detect_azurehound_command_line_arguments.yml +++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml @@ -29,42 +29,23 @@ tags: analytic_story: - Discovery Techniques automated_detection_testing: passed + confidence: 100 + context: + - Source:Endpoint + - Stage:Discovery dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + impact: 80 kill_chain_phases: - Reconnaissance + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD. mitre_attack_id: - T1087.002 - T1087.001 - T1482 - T1069.002 - T1069.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Discovery - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD. observable: - name: user type: User @@ -81,4 +62,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml index 1d18d9179e..e5c4338e31 100644 --- a/detections/endpoint/detect_azurehound_file_modifications.yml +++ b/detections/endpoint/detect_azurehound_file_modifications.yml @@ -32,36 +32,23 @@ tags: analytic_story: - Discovery Techniques automated_detection_testing: passed + confidence: 90 + context: + - Source:Endpoint + - Stage:Discovery dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + impact: 70 kill_chain_phases: - Reconnaissance + message: A file - $file_name$ was written to disk that is related to AzureHound, + a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$. mitre_attack_id: - T1087.002 - T1087.001 - T1482 - T1069.002 - T1069.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - file_path - - dest - - file_name - - process_id - - file_create_time - security_domain: endpoint - impact: 70 - confidence: 90 - # (impact * confidence)/100 - risk_score: 63 - context: - - Source:Endpoint - - Stage:Discovery - message: A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$. observable: - name: user type: User @@ -74,4 +61,17 @@ tags: - name: file_name type: File Name role: - - Victim \ No newline at end of file + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - file_path + - dest + - file_name + - process_id + - file_create_time + risk_score: 63 + security_domain: endpoint diff --git a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml index 982ccf9602..6d40f5c1e6 100644 --- a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml +++ b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml @@ -26,33 +26,21 @@ tags: cis20: - CIS 6 - CIS 8 + confidence: 70 + context: + - Source:Endpoint + - Stage:Lateral Movement + impact: 70 kill_chain_phases: - Actions on Objectives + message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type + 3, which may be indicative of the an account or group being changed by an anonymous + account. mitre_attack_id: - T1210 nist: - DE.AE - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventCode - - TargetUserName - - LogonType - - TargetDomainName - - user - security_domain: endpoint - impact: 70 - confidence: 70 - # (impact * confidence)/100 - risk_score: 49 - context: - - Source:Endpoint - - Stage:Lateral Movement - message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous account. observable: - name: user type: User @@ -65,4 +53,17 @@ tags: - name: EventCode type: Other role: - - Other \ No newline at end of file + - Other + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - TargetUserName + - LogonType + - TargetDomainName + - user + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index edc811df0d..3b82ee8cb3 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -33,16 +33,37 @@ tags: - CIS 3 - CIS 5 - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: The $source_image$ has attempted access to read $TargetImage$ was identified + on endpoint $Computer$, this is indicative of credential dumping and should be + investigated. mitre_attack_id: - T1003.001 nist: - PR.IP - PR.AC - DE.CM + observable: + - name: source_image + type: Other + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: TargetImage + type: Other + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -57,25 +78,5 @@ tags: - SourceProcessId - TargetImage - TargetProcessId - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 risk_score: 80 - context: - - Source:Endpoint - - Stage:Credential Access - message: The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be investigated. - observable: - - name: source_image - type: Other - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: TargetImage - type: Other - role: - - Victim + security_domain: endpoint diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml index 9179dd63bb..71b033d3bd 100644 --- a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml @@ -39,12 +39,28 @@ tags: analytic_story: - Malicious PowerShell automated_detection_testing: passed + confidence: 90 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log + impact: 90 kill_chain_phases: - Exploitation + message: The following behavior was identified and typically related to PowerShell-Empire + on $ComputerName$ by $User$. mitre_attack_id: - T1059.001 + observable: + - name: User + type: User + role: + - Victim + - name: ComputerName + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -56,21 +72,5 @@ tags: - ComputerName - User - EventCode - security_domain: endpoint - impact: 90 - confidence: 90 - # (impact * confidence)/100 risk_score: 81 - context: - - Source:Endpoint - - Stage:Execution - message: The following behavior was identified and typically related to PowerShell-Empire on $ComputerName$ by $User$. - observable: - - name: User - type: User - role: - - Victim - - name: ComputerName - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml index 9e3b33b230..a2afa3d8ec 100644 --- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml +++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml @@ -38,13 +38,29 @@ tags: automated_detection_testing: passed cis20: - CIS 16 + confidence: 60 + context: + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-security.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-system.log + impact: 60 + message: Multiple accounts have been locked out. Review $dest$ and results related + to $user$. mitre_attack_id: - T1078.002 nist: - PR.IP + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -55,21 +71,5 @@ tags: - nodename - All_Changes.result - All_Changes.dest - security_domain: access - impact: 60 - confidence: 60 - # (impact * confidence)/100 risk_score: 36 - context: - - Source:Endpoint - - Stage:Credential Access - message: Multiple accounts have been locked out. Review $dest$ and results related to $user$. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim + security_domain: access diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index da873d1531..3f7ae68b55 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -27,31 +27,20 @@ tags: automated_detection_testing: passed cis20: - CIS 16 + confidence: 60 + context: + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-security.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-system.log + impact: 60 + message: Multiple accounts have been locked out. Review $nodename$ and $result$ + related to $user$. mitre_attack_id: - T1078.003 nist: - PR.IP - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - All_Changes.result - - nodename - - All_Changes.user - security_domain: access - impact: 60 - confidence: 60 - # (impact * confidence)/100 - risk_score: 36 - context: - - Source:Endpoint - - Stage:Credential Access - message: Multiple accounts have been locked out. Review $nodename$ and $result$ related to $user$. observable: - name: user type: User @@ -61,3 +50,14 @@ tags: type: Other role: - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - All_Changes.result + - nodename + - All_Changes.user + risk_score: 36 + security_domain: access diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index a782ceca40..3a0920a67e 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -35,32 +35,20 @@ tags: analytic_story: - HAFNIUM Group automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1505.003 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Filesystem.file_path - - Filesystem.process_id - - Filesystem.file_name - - Filesystem.file_hash - - Filesystem.user - security_domain: endpoint - impact: 90 confidence: 90 - # (impact * confidence)/100 - risk_score: 81 context: - Source:Endpoint - Stage:Exploitation - message: A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log + impact: 90 + kill_chain_phases: + - Exploitation + message: A file - $file_name$ was written to disk that is related to IIS exploitation + previously performed by HAFNIUM. Review further file modifications on endpoint + $dest$ by user $user$. + mitre_attack_id: + - T1505.003 observable: - name: user type: User @@ -73,4 +61,17 @@ tags: - name: file_name type: File Name role: - - Victim \ No newline at end of file + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.file_path + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.file_hash + - Filesystem.user + risk_score: 81 + security_domain: endpoint diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index 23b0f2cf87..60aa2a26bb 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -37,38 +37,22 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: The following $process_name$ has been identified as renamed, spawning from + $parent_process_name$. mitre_attack_id: - T1218.001 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventID - - OriginalFileName - - process_name - - Computer - - User - - parent_process_name - - process_path - - CommandLine - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. observable: - name: user type: User @@ -85,4 +69,20 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventID + - OriginalFileName + - process_name + - Computer + - User + - parent_process_name + - process_path + - CommandLine + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index 3798beb2cc..ad59da5577 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -40,41 +40,23 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ spawning a child process, typically not normal + behavior. mitre_attack_id: - T1218.001 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior. observable: - name: user type: User @@ -91,4 +73,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index e75a78b101..6bad3f7f86 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -42,41 +42,23 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_proces_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ contacting a remote destination to potentally + download a malicious payload. mitre_attack_id: - T1218.001 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 90 - confidence: 100 - # (impact * confidence)/100 - risk_score: 90 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $parent_proces_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload. observable: - name: user type: User @@ -93,4 +75,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 90 + security_domain: endpoint diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index 136ac767ec..3e4f9cb8d7 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -44,41 +44,22 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 90 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: $process_name$ has been identified using Infotech Storage Handlers to load + a specific file within a CHM on $dest$ under user $user$. mitre_attack_id: - T1218.001 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 90 - # (impact * confidence)/100 - risk_score: 72 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$. observable: - name: user type: User @@ -91,4 +72,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml index 9535fda6e1..e71f9ddae9 100644 --- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml +++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml @@ -35,35 +35,22 @@ tags: cis20: - CIS 6 - CIS 8 + confidence: 80 + context: + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: A process, $Image$, has loaded $ImageLoaded$ that are typically related + to credential dumping on $Computer$. Review for further details. mitre_attack_id: - T1003.001 nist: - DE.AE - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventCode - - ImageLoaded - - ProcessId - - Computer - - Image - security_domain: endpoint - impact: 80 - confidence: 80 - # (impact * confidence)/100 - risk_score: 64 - context: - - Source:Endpoint - - Stage:Credential Access - message: A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details. observable: - name: user type: User @@ -80,4 +67,17 @@ tags: - name: Image type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ImageLoaded + - ProcessId + - Computer + - Image + risk_score: 64 + security_domain: endpoint diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml index 7e8214f39c..284ff4d3de 100644 --- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml @@ -36,12 +36,28 @@ tags: analytic_story: - Malicious PowerShell automated_detection_testing: passed + confidence: 100 + context: + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log + impact: 90 kill_chain_phases: - Exploitation + message: The following behavior was identified and typically related to MimiKatz + being loaded within the context of PowerShell on $ComputerName$ by $User$. mitre_attack_id: - T1003 + observable: + - name: User + type: User + role: + - Victim + - name: ComputerName + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -53,21 +69,5 @@ tags: - ComputerName - User - EventCode - security_domain: endpoint - impact: 90 - confidence: 100 - # (impact * confidence)/100 risk_score: 90 - context: - - Source:Endpoint - - Stage:Credential Access - message: The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $ComputerName$ by $User$. - observable: - - name: User - type: User - role: - - Victim - - name: ComputerName - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index ea7abb1e9c..e49c242eb8 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -34,41 +34,23 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log + impact: 90 kill_chain_phases: - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense + evasion. mitre_attack_id: - T1218.005 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 90 - confidence: 100 - # (impact * confidence)/100 - risk_score: 90 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion. observable: - name: user type: User @@ -85,4 +67,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 90 + security_domain: endpoint diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index 2a5cb2efb5..b789c2e0f2 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -31,38 +31,22 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Exploitation + message: The following $process_name$ has been identified as renamed, spawning from + $parent_process_name$. mitre_attack_id: - T1218.005 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventID - - OriginalFileName - - process_name - - Computer - - User - - parent_process_name - - process_path - - CommandLine - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. observable: - name: user type: User @@ -79,4 +63,20 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventID + - OriginalFileName + - process_name + - Computer + - User + - parent_process_name + - process_path + - CommandLine + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index ab70994059..e2f9f1028e 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -35,41 +35,23 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $est$ by user $user$ attempting to access a remote destination to + download an additional payload. mitre_attack_id: - T1218.005 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $est$ by user $user$ attempting to access a remote destination to download an additional payload. observable: - name: user type: User @@ -86,4 +68,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 974714c678..d35b6073cb 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -26,18 +26,34 @@ tags: automated_detection_testing: passed cis20: - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Persistence dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log + impact: 60 kill_chain_phases: - Actions on Objectives - Command and Control + message: A $user$ on $dest$ was added recently. Identify if this was legitimate + behavior or not. mitre_attack_id: - T1136.001 nist: - PR.AC - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -49,21 +65,5 @@ tags: - member_id - dest - user - security_domain: access - impact: 60 - confidence: 70 - # (impact * confidence)/100 risk_score: 42 - context: - - Source:Endpoint - - Stage:Persistence - message: A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: access diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index a8b796c5b3..2f97f70f17 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -31,41 +31,23 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 70 + context: + - Source:Endpoint + - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.009/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to perform privilege escalation by + using unquoted service paths. mitre_attack_id: - T1574.009 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 70 - confidence: 70 - # (impact * confidence)/100 - risk_score: 49 - context: - - Source:Endpoint - - Stage:Privilege Escalation - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths. observable: - name: user type: User @@ -82,4 +64,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml index 160eda3d93..ae1f9e1040 100644 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml @@ -32,43 +32,25 @@ tags: automated_detection_testing: passed cis20: - CIS 2 + confidence: 80 + context: + - Source:Endpoint + - Stage:Discovery dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/discovery_commands/windows-sysmon.log + impact: 40 kill_chain_phases: - Installation - Command and Control - Actions on Objectives + message: An instance of $parent_process_name$ spawning multiple $process_name$ was + identified on endpoint $dest$ by user $user$ typically not a normal behavior of + the process. mitre_attack_id: - T1016 nist: - ID.AM - PR.DS - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 40 - confidence: 80 - # (impact * confidence)/100 - risk_score: 32 - context: - - Source:Endpoint - - Stage:Discovery - message: An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process. observable: - name: user type: User @@ -85,4 +67,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 32 + security_domain: endpoint diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml index bd9a778f31..efbe844e4f 100644 --- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml +++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml @@ -32,41 +32,22 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon.log + impact: 80 kill_chain_phases: - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ running prohibited applications. mitre_attack_id: - T1059.003 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Execution - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications. observable: - name: user type: User @@ -83,4 +64,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 7cb1a56328..bb7ce23b33 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -16,8 +16,9 @@ description: This search looks for events where `PsExec.exe` is run with the `ac within the command line. search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process=*psexec* Processes.process=*accepteula* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`| + where Processes.process=*psexec* Processes.process=*accepteula* by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be @@ -40,41 +41,22 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 70 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.002/atomic_red_team/windows-sysmon.log + impact: 50 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ running the utility for possibly the first time. mitre_attack_id: - T1021.002 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 50 - confidence: 70 - # (impact * confidence)/100 - risk_score: 35 - context: - - Source:Endpoint - - Stage:Execution - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time. observable: - name: user type: User @@ -91,4 +73,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 35 + security_domain: endpoint diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index 16d6865dbe..5f34b6ad17 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -34,34 +34,20 @@ tags: - DarkSide Ransomware - Ransomware automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log - kill_chain_phases: - - Exfiltration - mitre_attack_id: - - T1020 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - security_domain: endpoint - impact: 50 confidence: 70 - # (impact * confidence)/100 - risk_score: 35 context: - Source:Endpoint - Stage:Exfiltration - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log + impact: 50 + kill_chain_phases: + - Exfiltration + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service + to move files or folders. + mitre_attack_id: + - T1020 observable: - name: user type: User @@ -78,4 +64,19 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 35 + security_domain: endpoint diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index c369f9d593..2e12fc23ff 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -37,37 +37,23 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ spawning a child process, typically not normal + behavior for $parent_process_name$. mitre_attack_id: - T1218.009 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.parent_process_name - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process - - Processes.process_id - - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 80 - # (impact * confidence)/100 - risk_score: 64 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior for $parent_process_name$. observable: - name: user type: User @@ -84,4 +70,19 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 64 + security_domain: endpoint diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml index 6c3e720c69..7f999ed45c 100644 --- a/detections/endpoint/detect_regasm_with_network_connection.yml +++ b/detections/endpoint/detect_regasm_with_network_connection.yml @@ -37,15 +37,35 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: An instance of $process_name$ contacting a remote destination was identified + on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. mitre_attack_id: - T1218.009 nist: - PR.PT - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security @@ -60,25 +80,5 @@ tags: - src_ip - dest_host - dest_ip - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index 708324c566..099a796657 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -34,40 +34,22 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Actions on Objectives + message: The process $process_name$ was spawned by $parent_image$ without any command-line + arguments on $dest$ by $user$. mitre_attack_id: - T1218.009 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventID - - process_name - - OriginalFileName - - CommandLine - - dest - - User - - ParentImage - - ParentCommandLine - - process_path - - Computer - security_domain: endpoint - impact: 70 - confidence: 70 - # (impact * confidence)/100 - risk_score: 49 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. observable: - name: user type: User @@ -85,3 +67,21 @@ tags: type: Process role: - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventID + - process_name + - OriginalFileName + - CommandLine + - dest + - User + - ParentImage + - ParentCommandLine + - process_path + - Computer + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index c70806f735..5eefd5ee57 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -36,38 +36,22 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ typically not normal for this process. mitre_attack_id: - T1218.009 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.parent_process_name - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 80 - # (impact * confidence)/100 - risk_score: 64 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ typically not normal for this process. observable: - name: user type: User @@ -84,4 +68,20 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 64 + security_domain: endpoint diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml index fa6e35b81f..c41509457c 100644 --- a/detections/endpoint/detect_regsvcs_with_network_connection.yml +++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml @@ -37,15 +37,35 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: An instance of $process_name$ contacting a remote destination was identified + on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. mitre_attack_id: - T1218.009 nist: - PR.PT - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security @@ -59,25 +79,5 @@ tags: - User - src_ip - dest_host - security_domain: Endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process \ No newline at end of file + security_domain: Endpoint diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index 000e819ef7..a7f1892aca 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -34,15 +34,39 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Actions on Objectives + message: The process $process_name$ was spawned by $parent_image$ without any command-line + arguments on $dest$ by $user$. mitre_attack_id: - T1218.009 nist: - PR.PT - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_image + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security @@ -60,29 +84,5 @@ tags: - OriginalFileName - process_path - Computer - security_domain: endpoint - impact: 70 - confidence: 70 - # (impact * confidence)/100 risk_score: 49 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_image - type: Parent Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index 1f668f6db9..3628c2ca43 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -42,40 +42,22 @@ tags: cis20: - CIS 8 - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ in an attempt + to bypass detection and preventative controls was identified on endpoint $dest$ + by user $user$. mitre_attack_id: - T1218.010 nist: - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$. observable: - name: user type: User @@ -92,4 +74,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml index 8bbff4ae9e..15b9ae62ad 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/endpoint/detect_renamed_7_zip.yml @@ -26,35 +26,19 @@ tags: analytic_story: - Collection and Staging automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log - kill_chain_phases: - - Exfiltration - mitre_attack_id: - - T1560.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - dest - - User - - parent_process_name - - process_name - - OriginalFileName - - process_path - - CommandLine - - Product - security_domain: endpoint - impact: 30 confidence: 90 - # (impact * confidence)/100 - risk_score: 27 context: - Source:Endpoint - Stage:Collection - message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + impact: 30 + kill_chain_phases: + - Exfiltration + message: The following $process_name$ has been identified as renamed, spawning from + $parent_process_name$ on $dest$ by $user$. + mitre_attack_id: + - T1560.001 observable: - name: user type: User @@ -71,4 +55,20 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - User + - parent_process_name + - process_name + - OriginalFileName + - process_path + - CommandLine + - Product + risk_score: 27 + security_domain: endpoint diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index f0282c12ec..90c383d83f 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -34,37 +34,21 @@ tags: - DarkSide Ransomware - Lateral Movement automated_detection_testing: passed + confidence: 90 + context: + - Source:Endpoint + - Stage:Collection dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log + impact: 30 kill_chain_phases: - Exploitation - Lateral Movement - Execution + message: The following $process_name$ has been identified as renamed, spawning from + $parent_process_name$ on $dest$ by $user$. mitre_attack_id: - T1569.002 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - dest - - User - - parent_process_name - - process_name - - OriginalFileName - - process_path - - CommandLine - - Product - security_domain: endpoint - impact: 30 - confidence: 90 - # (impact * confidence)/100 - risk_score: 27 - context: - - Source:Endpoint - - Stage:Collection - message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. observable: - name: user type: User @@ -81,4 +65,20 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - User + - parent_process_name + - process_name + - OriginalFileName + - process_path + - CommandLine + - Product + risk_score: 27 + security_domain: endpoint diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml index f7e494eca1..24d59a4971 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/endpoint/detect_renamed_rclone.yml @@ -32,32 +32,19 @@ tags: - DarkSide Ransomware - Ransomware automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log - kill_chain_phases: - - Exfiltration - mitre_attack_id: - - T1020 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - OriginalFileName - - process_name - - process_path - - CommandLine - - dest - security_domain: endpoint - impact: 30 confidence: 90 - # (impact * confidence)/100 - risk_score: 27 context: - Source:Endpoint - Stage:Collection - message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log + impact: 30 + kill_chain_phases: + - Exfiltration + message: The following $process_name$ has been identified as renamed, spawning from + $parent_process_name$ on $dest$ by $user$. + mitre_attack_id: + - T1020 observable: - name: user type: User @@ -74,4 +61,17 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - OriginalFileName + - process_name + - process_path + - CommandLine + - dest + risk_score: 27 + security_domain: endpoint diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index 7a90d03aae..74fa6a310b 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -29,36 +29,20 @@ tags: analytic_story: - Collection and Staging automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log - kill_chain_phases: - - Exploitation - - Exfiltration - mitre_attack_id: - - T1560.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - dest - - User - - parent_process_name - - process_name - - OriginalFileName - - process_path - - CommandLine - - Product - security_domain: endpoint - impact: 30 confidence: 90 - # (impact * confidence)/100 - risk_score: 27 context: - Source:Endpoint - Stage:Collection - message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + impact: 30 + kill_chain_phases: + - Exploitation + - Exfiltration + message: The following $process_name$ has been identified as renamed, spawning from + $parent_process_name$ on $dest$ by $user$. + mitre_attack_id: + - T1560.001 observable: - name: user type: User @@ -75,4 +59,20 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - User + - parent_process_name + - process_name + - OriginalFileName + - process_path + - CommandLine + - Product + risk_score: 27 + security_domain: endpoint diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index c881803914..4652b734c5 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -17,9 +17,10 @@ description: The following analytic identifies rundll32.exe loading advpack.dll It's possible other files are on disk. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process=*advpack* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___advpack_filter`' + Processes.process=*advpack* by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_rundll32_application_control_bypass___advpack_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -38,37 +39,23 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll + and ieadvpack.dll by calling the LaunchINFSection function on the command line + was identified on endpoint $dest$ by user $user$. mitre_attack_id: - T1218.011 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. observable: - name: user type: User @@ -85,4 +72,19 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index 3c18b96368..675c1cce4b 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -17,9 +17,10 @@ description: The following analytic identifies rundll32.exe loading setupapi.dll It's possible other files are on disk. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process=*setupapi* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___setupapi_filter`' + Processes.process=*setupapi* by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_rundll32_application_control_bypass___setupapi_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -38,37 +39,23 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll + and iesetupapi.dll by calling the LaunchINFSection function on the command line + was identified on endpoint $dest$ by user $user$. mitre_attack_id: - T1218.011 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. observable: - name: user type: User @@ -85,4 +72,19 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index 38c9efcd55..cc40cc3050 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -17,9 +17,10 @@ description: The following analytic identifies rundll32.exe loading syssetup.dll files are on disk. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process=*syssetup* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___syssetup_filter`' + Processes.process=*syssetup* by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_rundll32_application_control_bypass___syssetup_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -38,37 +39,23 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll + by calling the LaunchINFSection function on the command line was identified on + endpoint $dest$ by user $user$. mitre_attack_id: - T1218.011 nist: - PR.PT - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. observable: - name: user type: User @@ -85,4 +72,19 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index 66ef2445cc..b59c2a91bc 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -37,15 +37,28 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 80 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Suspicious rundll32.exe inline HTA execution on $dest$ mitre_attack_id: - T1218.005 nist: - PR.PT - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -58,18 +71,5 @@ tags: - Processes.dest - Processes.parent_process_name - Processes.parent_process - security_domain: endpoint - impact: 70 - confidence: 80 risk_score: 56 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Execution - - Stage:Defense Evasion - message: Suspicious rundll32.exe inline HTA execution on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index 1193cc70c4..d303f1135c 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -33,16 +33,27 @@ tags: - Discovery Techniques - Ransomware automated_detection_testing: passed + confidence: 80 + context: + - Source:Endpoint + - Stage:Discovery dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + impact: 30 kill_chain_phases: - Reconnaissance + message: Possible SharpHound command-Line arguments identified on $dest$ mitre_attack_id: - T1087.002 - T1087.001 - T1482 - T1069.002 - T1069.001 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -56,16 +67,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - security_domain: endpoint - impact: 30 - confidence: 80 risk_score: 24 - context: - - Source:Endpoint - - Stage:Discovery - message: Possible SharpHound command-Line arguments identified on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim + security_domain: endpoint diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index 056b832c2b..55fdc95def 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -43,16 +43,31 @@ tags: - Discovery Techniques - Ransomware automated_detection_testing: passed + confidence: 80 + context: + - Source:Endpoint + - Stage:Discovery dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + impact: 30 kill_chain_phases: - Reconnaissance + message: Potential SharpHound file modifications identified on $dest$ mitre_attack_id: - T1087.002 - T1087.001 - T1482 - T1069.002 - T1069.001 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -64,20 +79,5 @@ tags: - file_name - process_id - file_create_time - security_domain: endpoint - impact: 30 - confidence: 80 risk_score: 24 - context: - - Source:Endpoint - - Stage:Discovery - message: Potential SharpHound file modifications identified on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim + security_domain: endpoint diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index 5a1a51c969..c97ebf6a5b 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -36,16 +36,27 @@ tags: - Discovery Techniques - Ransomware automated_detection_testing: passed + confidence: 80 + context: + - Source:Endpoint + - Stage:Discovery dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + impact: 30 kill_chain_phases: - Reconnaissance + message: Potential SharpHound binary identified on $dest$ mitre_attack_id: - T1087.002 - T1087.001 - T1482 - T1069.002 - T1069.001 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -60,16 +71,5 @@ tags: - process_path - CommandLine - Product - security_domain: endpoint - impact: 30 - confidence: 80 risk_score: 24 - context: - - Source:Endpoint - - Stage:Discovery - message: Potential SharpHound binary identified on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml index bf3385df95..bdaa783dc7 100644 --- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml +++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml @@ -30,15 +30,28 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/cmd_spawns_cscript/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: cmd.exe launching script interpreters on $dest$ mitre_attack_id: - T1059.003 nist: - PR.PT - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -51,18 +64,5 @@ tags: - Processes.parent_process - Processes.user - Processes.dest - security_domain: endpoint - impact: 70 - confidence: 50 risk_score: 35 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Execution - - Stage:Defense Evasion - message: cmd.exe launching script interpreters on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/endpoint/detect_wmi_event_subscription_persistence.yml index 1224aed466..ebe1a2e236 100644 --- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml +++ b/detections/endpoint/detect_wmi_event_subscription_persistence.yml @@ -44,12 +44,24 @@ tags: analytic_story: - Suspicious WMI Use automated_detection_testing: passed + confidence: 90 + context: + - Source:Endpoint + - Stage:Persistence + - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Possible malicious WMI Subscription created on $dest$ mitre_attack_id: - T1546.003 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -59,17 +71,5 @@ tags: - Destination - Computer - User - security_domain: endpoint - impact: 70 - confidence: 90 risk_score: 63 - context: - - Source:Endpoint - - Stage:Persistence - - Stage:Privilege Escalation - message: Possible malicious WMI Subscription created on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index 441352c75f..3b2c92e144 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -27,12 +27,23 @@ tags: analytic_story: - Ransomware automated_detection_testing: passed + confidence: 80 + context: + - Source: Endpoint + - Stage: Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log + impact: 30 kill_chain_phases: - Exploitation + message: WevtUtil.exe used to disable Event Logging on $dest mitre_attack_id: - T1070.001 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -47,16 +58,5 @@ tags: - Processes.user - Processes.process_id - Processes.process_guid - security_domain: endpoint - impact: 30 - confidence: 80 risk_score: 24 - context: - - Source: Endpoint - - Stage: Defense Evasion - message: WevtUtil.exe used to disable Event Logging on $dest - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 1a1c75030e..27796f8ffe 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -6,11 +6,11 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search identifies modification of registry to disable the - regedit or registry tools of the windows operating system. Since registry tool is a - swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this - application to prevent the removal of their registry entry such as persistence, - file less components and defense evasion. +description: This search identifies modification of registry to disable the regedit + or registry tools of the windows operating system. Since registry tool is a swiss + knife in analyzing registry, malware such as RAT or trojan Spy disable this application + to prevent the removal of their registry entry such as persistence, file less components + and defense evasion. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name @@ -27,12 +27,18 @@ tags: analytic_story: - Windows Defense Evasion Tactics automated_detection_testing: passed + confidence: 100 + context: + - Source: Endpoint + - Stage: Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + impact: 40 kill_chain_phases: - Exploitation + message: Disabled Registry Tools mitre_attack_id: - T1562.001 product: @@ -46,11 +52,5 @@ tags: - Registry.user - Registry.dest - Registry.registry_value_name - security_domain: endpoint - impact: 40 - confidence: 100 risk_score: 40 - context: - - Source: Endpoint - - Stage: Defense Evasion - message: Disabled Registry Tools \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index cb90ed3d0d..edf23da40e 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -6,10 +6,10 @@ author: Teoderick Contreras, Mauricio Velazco, Splunk type: batch datamodel: - Endpoint -description: The following analytic is to identify a modification in the Windows registry to prevent - users from seeing all the files with hidden attributes. This event or techniques are - known on some worm and trojan spy malware that will drop hidden files on the infected - machine. +description: The following analytic is to identify a modification in the Windows registry + to prevent users from seeing all the files with hidden attributes. This event or + techniques are known on some worm and trojan spy malware that will drop hidden files + on the infected machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" @@ -29,12 +29,18 @@ tags: analytic_story: - Windows Defense Evasion Tactics automated_detection_testing: passed + confidence: 100 + context: + - Source: Endpoint + - Stage: Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + impact: 40 kill_chain_phases: - Exploitation + message: Disabled 'Show Hidden Files' mitre_attack_id: - T1564.001 - T1562.001 @@ -49,11 +55,5 @@ tags: - Registry.user - Registry.dest - Registry.registry_value_nam - security_domain: endpoint - impact: 40 - confidence: 100 risk_score: 40 - context: - - Source: Endpoint - - Stage: Defense Evasion - message: Disabled 'Show Hidden Files' + security_domain: endpoint diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 2eb7462bba..aff4a0090a 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -31,10 +31,16 @@ tags: analytic_story: - XMRig automated_detection_testing: passed + confidence: 100 + context: + - Source: Endpoint + - Stage: Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log + impact: 40 kill_chain_phases: - Exploitation + message: Disabled 'Windows App Hotkeys' mitre_attack_id: - T1562.001 product: @@ -47,11 +53,5 @@ tags: - Registry.registry_path - Registry.registry_value_name - Registry.dest Registry.user - security_domain: endpoint - impact: 40 - confidence: 100 risk_score: 40 - context: - - Source: Endpoint - - Stage: Defense Evasion - message: Disabled 'Windows App Hotkeys' \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 4353463a32..5cb68a57a1 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -35,14 +35,25 @@ tags: - Ransomware - Revil Ransomware automated_detection_testing: passed + confidence: 100 + context: + - Source: Endpoint + - Stage: Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + impact: 40 kill_chain_phases: - Exploitation + message: Windows Defender real time behavior monitoring disabled on $dest mitre_attack_id: - T1562.001 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -54,16 +65,5 @@ tags: - Registry.user - Registry.dest - Registry.registry_value_name - security_domain: endpoint - impact: 40 - confidence: 100 risk_score: 40 - context: - - Source: Endpoint - - Stage: Defense Evasion - message: Windows Defender real time behavior monitoring disabled on $dest - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index 5e5c5b7045..dce41c7ee2 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -27,7 +27,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics automated_detection_testing: passed - confidence: 100 + confidence: 50 context: - Source:Endpoint - Stage:Defense Evasion @@ -35,26 +35,21 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - impact: 40 + impact: 50 kill_chain_phases: - Exploitation - message: $Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$ - to disable the smartscreen protection of windows machine + message: The Windows Smartscreen was disabled on $dest$ by $user$. mitre_attack_id: - T1562.001 observable: - - name: Registry.dest - type: Endpoint - role: - - Victim - - name: Registry.use + - name: user type: User role: - Victim - - name: Registry.registry_key_name - type: Other + - name: dest + type: Hostname role: - - Target + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -66,22 +61,5 @@ tags: - Registry.user - Registry.dest - Registry.registry_value_nam - risk_score: 40 - security_domain: endpoint - impact: 50 - confidence: 50 - # (impact * confidence)/100 risk_score: 25 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The Windows Smartscreen was disabled on $dest$ by $user$. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 167d7544aa..7389e24930 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -26,7 +26,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics automated_detection_testing: passed - confidence: 100 + confidence: 50 context: - Source:Endpoint - Stage:Defense Evasion @@ -34,26 +34,21 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - impact: 40 + impact: 50 kill_chain_phases: - Exploitation - message: $Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$ - to disable to disable the cmd prompt application of a windows machine + message: The Windows command prompt was disabled on $dest$ by $user$. mitre_attack_id: - T1562.001 observable: - - name: Registry.dest - type: Endpoint - role: - - Victim - - name: Registry.user + - name: user type: User role: - Victim - - name: Registry.registry_key_name - type: Other + - name: dest + type: Hostname role: - - Target + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -65,22 +60,5 @@ tags: - Registry.user - Registry.dest - Registry.registry_value_name - risk_score: 40 - security_domain: endpoint - impact: 50 - confidence: 50 - # (impact * confidence)/100 risk_score: 25 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The Windows command prompt was disabled on $dest$ by $user$. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index 6c28a3509f..1b3335f605 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -25,7 +25,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics automated_detection_testing: passed - confidence: 100 + confidence: 50 context: - Source:Endpoint - Stage:Defense Evasion @@ -33,26 +33,21 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - impact: 40 + impact: 50 kill_chain_phases: - Exploitation - message: $Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$ - to disable to disable the control panel window on a windows machine + message: The Windows Control Panel was disabled on $dest$ by $user$. mitre_attack_id: - T1562.001 observable: - - name: Registry.dest - type: Endpoint - role: - - Victim - - name: Registry.user + - name: user type: User role: - Victim - - name: Registry.registry_key_name - type: Other + - name: dest + type: Hostname role: - - Target + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -64,22 +59,5 @@ tags: - Registry.user - Registry.dest - Registry.registry_value_name - risk_score: 40 - security_domain: endpoint - impact: 50 - confidence: 50 - # (impact * confidence)/100 risk_score: 25 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The Windows Control Panel was disabled on $dest$ by $user$. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml index 49a635af4f..1fcf696375 100644 --- a/detections/endpoint/disabling_firewall_with_netsh.yml +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -27,7 +27,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics automated_detection_testing: passed - confidence: 100 + confidence: 50 context: - Source:Endpoint - Stage:Defense Evasion @@ -35,26 +35,21 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - impact: 40 + impact: 50 kill_chain_phases: - Exploitation - message: $Processes.user$ on $Processes.dest$ used the netsh application in a suspicious - manner to disable the firewall + message: The Windows Firewall was disabled on $dest$ by $user$. mitre_attack_id: - T1562.001 observable: - - name: Processes.dest - type: Endpoint - role: - - Victim - - name: Processes.user + - name: user type: User role: - Victim - - name: Processes.process - type: Process + - name: dest + type: Hostname role: - - Target + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -69,22 +64,5 @@ tags: - Processes.process_name - Processes.process_id - Processes.parent_process_id - risk_score: 40 - security_domain: endpoint - impact: 50 - confidence: 50 - # (impact * confidence)/100 risk_score: 25 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The Windows Firewall was disabled on $dest$ by $user$. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index b9633b7653..113466f76d 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -27,7 +27,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics automated_detection_testing: passed - confidence: 100 + confidence: 50 context: - Source:Endpoint - Stage:Defense Evasion @@ -35,27 +35,21 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - impact: 40 + impact: 50 kill_chain_phases: - Exploitation - message: $Registry.user$ on $Registry.dest modified registry key name=$Registry.registry_key_name$ - to disable the folder options feature of windows to show hidden files, file extensions, - etc + message: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$. mitre_attack_id: - T1562.001 observable: - - name: Registry.dest - type: Endpoint - role: - - Victim - - name: Registry.user + - name: user type: User role: - Victim - - name: Registry.registry_key_name - type: Other + - name: dest + type: Hostname role: - - Target + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -67,22 +61,5 @@ tags: - Registry.user - Registry.dest - Registry.registry_value_name - risk_score: 40 - security_domain: endpoint - impact: 50 - confidence: 50 - # (impact * confidence)/100 risk_score: 25 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml index c87ed46cfc..758a29fa61 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/endpoint/disabling_net_user_account.yml @@ -29,54 +29,19 @@ tags: analytic_story: - XMRig automated_detection_testing: passed - confidence: 100 - context: - - Source:Endpoint - - Stage:Defense Evasion - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log - impact: 40 - kill_chain_phases: - - Exploitation - message: $Processes.user$ on $Processes.dest$ used a suspicious command ($Processes.process_name$) - that disabled a user account using the net.exe utility native to Windows - mitre_attack_id: - - T1531 - observable: - - name: Processes.dest - type: Endpoint - role: - - Victim - - name: Processes.user - type: User - role: - - Victim - - name: Processes.process_name - type: Process - role: - - Target - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.process_name - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_id - - Processes.parent_process - risk_score: 40 - security_domain: endpoint - impact: 70 confidence: 60 - # (impact * confidence)/100 - risk_score: 42 context: - Source:Endpoint - Stage:Persistence - message: An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + disabling a user account on endpoint $dest$ by user $user$. + mitre_attack_id: + - T1531 observable: - name: user type: User @@ -93,4 +58,18 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_id + - Processes.parent_process + risk_score: 42 + security_domain: endpoint diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index bf3198ba73..adbb138c8e 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -28,7 +28,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics automated_detection_testing: passed - confidence: 100 + confidence: 50 context: - Source:Endpoint - Stage:Defense Evasion @@ -36,26 +36,22 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - impact: 40 + impact: 50 kill_chain_phases: - Exploitation - message: $Registry.user$ on $Registry.dest$ modified registry key $Registry.registry_key_name$ - to disable run application in window start menu + message: The Windows registry was modified to disable run application in window + start menu on $dest$ by $user$. mitre_attack_id: - T1562.001 observable: - - name: Registry.dest - type: Endpoint - role: - - Victim - - name: Registry.use + - name: user type: User role: - Victim - - name: Registry.registry_key_name - type: Other + - name: dest + type: Hostname role: - - Target + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -67,22 +63,5 @@ tags: - Registry.user - Registry.dest - Registry.registry_value_name - risk_score: 40 - security_domain: endpoint - impact: 50 - confidence: 50 - # (impact * confidence)/100 risk_score: 25 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The Windows registry was modified to disable run application in window start menu on $dest$ by $user$. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index a54ca8b0bf..f771384342 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -29,35 +29,31 @@ tags: automated_detection_testing: passed cis20: - CIS 8 - confidence: 100 + confidence: 60 context: - Source:Endpoint - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log - impact: 40 + impact: 70 kill_chain_phases: - Actions on Objectives - message: $Registry.user$ on $Registry.dest$ modified registry key=$Registry.registry_key_name$ - that controls the enforcement of Windows User Account Control (UAC) + message: The Windows registry keys that control the enforcement of Windows User + Account Control (UAC) were modified on $dest$ by $user$. mitre_attack_id: - T1548.002 nist: - PR.PT - DE.CM observable: - - name: Registry.dest - type: Endpoint - role: - - Victim - - name: Registry.user + - name: user type: User role: - Victim - - name: Registry.registry_key_name - type: Other + - name: dest + type: Hostname role: - - Target + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -70,22 +66,5 @@ tags: - Registry.registry_key_name - Registry.user - Registry.action - risk_score: 40 - security_domain: endpoint - impact: 70 - confidence: 60 - # (impact * confidence)/100 risk_score: 42 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 8ba204f044..1b10e53c63 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -28,7 +28,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics automated_detection_testing: passed - confidence: 100 + confidence: 70 context: - Source:Endpoint - Stage:Defense Evasion @@ -39,23 +39,19 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: $Registry.user$ on $Registry.dest$ modified registry key=$Registry.registry_key_name$ - which disables the system restore of a machine + message: The Windows registry was modified to disable system restore on $dest$ by + $user$. mitre_attack_id: - T1562.001 observable: - - name: Registry.dest - type: Endpoint - role: - - Victim - - name: Registry.user + - name: user type: User role: - Victim - - name: Registry.registry_key_name - type: Other + - name: dest + type: Hostname role: - - Target + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -67,22 +63,5 @@ tags: - Registry.user - Registry.dest - Registry.registry_value_name - risk_score: 70 - security_domain: endpoint - impact: 70 - confidence: 70 - # (impact * confidence)/100 risk_score: 49 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The Windows registry was modified to disable system restore on $dest$ by $user$. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 3adcfa500a..8293164724 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -27,7 +27,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics automated_detection_testing: passed - confidence: 100 + confidence: 60 context: - Source:Endpoint - Stage:Defense Evasion @@ -35,26 +35,21 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log - impact: 40 + impact: 70 kill_chain_phases: - Exploitation - message: $Registry.user$ on $Registry.dest$ modified registry key=$Registry.registry_key_name$ - which disables the task manager of windows operating system + message: The Windows Task Manager was disabled on $dest$ by $user$. mitre_attack_id: - T1562.001 observable: - - name: Registry.dest - type: Endpoint - role: - - Victim - - name: Registry.user + - name: user type: User role: - Victim - - name: Registry.registry_key_name - type: Other + - name: dest + type: Hostname role: - - Target + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -66,22 +61,5 @@ tags: - Registry.user - Registry.dest - Registry.registry_value_name - risk_score: 40 - security_domain: endpoint - impact: 70 - confidence: 60 - # (impact * confidence)/100 risk_score: 42 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The Windows Task Manager was disabled on $dest$ by $user$. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 681ca72282..4b10a4e40c 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -33,33 +33,19 @@ tags: analytic_story: - Cobalt Strike automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1055 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventID - - process_name - - process_id - - parent_process_name - - dest_port - - process_path - security_domain: endpoint - impact: 70 confidence: 70 - # (impact * confidence)/100 - risk_score: 49 context: - Source:Endpoint - Stage:Defense Evasion - message: The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log + impact: 70 + kill_chain_phases: + - Exploitation + message: The process $process_name$ was spawned by $parent_image$ without any command-line + arguments on $dest$ by $user$. + mitre_attack_id: + - T1055 observable: - name: user type: User @@ -76,4 +62,18 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventID + - process_name + - process_id + - parent_process_name + - dest_port + - process_path + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index 272cdbee03..ce3836365d 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -36,38 +36,19 @@ tags: - Command and Control - Data Exfiltration automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1048 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline - - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - security_domain: endpoint - impact: 90 confidence: 80 - # (impact * confidence)/100 - risk_score: 72 context: - Source:Endpoint - Stage:Exfiltration - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log + impact: 90 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration. + mitre_attack_id: + - T1048 observable: - name: user type: User @@ -84,4 +65,23 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 728d3688e5..8a23b328d1 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -28,12 +28,28 @@ tags: analytic_story: - XMRig automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Suspicious files were downloaded with the Telegram application on $dest$ + by $user$. mitre_attack_id: - T1105 + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -46,21 +62,5 @@ tags: - process_id - TargetFilename - Hash - security_domain: endpoint - impact: 70 - confidence: 70 - # (impact * confidence)/100 risk_score: 49 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: Suspicious files were downloaded with the Telegram application on $dest$ by $user$. - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index ac23e8ffc4..e90e3f052a 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -47,34 +47,19 @@ tags: analytic_story: - Domain Trust Discovery automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1482 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - security_domain: endpoint - impact: 80 confidence: 90 - # (impact * confidence)/100 - risk_score: 72 context: - Source:Endpoint - Stage:Discovery - message: An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + performing domain discovery on endpoint $dest$ by user $user$. + mitre_attack_id: + - T1482 observable: - name: user type: User @@ -91,4 +76,19 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 72 + security_domain: endpoint diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index cfc859c177..7d132fdf86 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -31,36 +31,21 @@ tags: - CIS 3 - CIS 5 - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. mitre_attack_id: - T1003.001 nist: - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Credential Access - message: An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. observable: - name: user type: User @@ -77,4 +62,19 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 270489f8ac..d20b179997 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -40,36 +40,21 @@ tags: - CIS 3 - CIS 5 - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: An instance of $parent_process_name$ spawning $process_name$ was identified + attempting to dump lsass.exe on endpoint $dest$ by user $user$. mitre_attack_id: - T1003.001 nist: - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe on endpoint $dest$ by user $user$. observable: - name: user type: User @@ -86,4 +71,19 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/dump_lsass_via_procdump_rename.yml b/detections/endpoint/dump_lsass_via_procdump_rename.yml index cecfdad271..347b31ece3 100644 --- a/detections/endpoint/dump_lsass_via_procdump_rename.yml +++ b/detections/endpoint/dump_lsass_via_procdump_rename.yml @@ -37,35 +37,21 @@ tags: - CIS 3 - CIS 5 - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: The following $process_name$ has been identified as renamed, spawning from + $parent_process_name$ on $dest$, attempting to dump lsass.exe. mitre_attack_id: - T1003.001 nist: - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - OriginalFileName - - process_name - - EventID - - CommandLine - - Computer - - parent_process_name - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$, attempting to dump lsass.exe. observable: - name: dest type: Hostname @@ -78,4 +64,18 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - OriginalFileName + - process_name + - EventID + - CommandLine + - Computer + - parent_process_name + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index d2b79306e6..0bfc3ab4de 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -27,12 +27,27 @@ tags: analytic_story: - Prohibited Traffic Allowed or Protocol Mismatch automated_detection_testing: passed + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + impact: 80 kill_chain_phases: - Exploitation + message: RDP was moved to a non-standard port on $dest$ by $user$. mitre_attack_id: - T1021 + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -43,21 +58,5 @@ tags: - Registry.dest - Registry.user - Registry.registry_value_name - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: RDP was moved to a non-standard port on $dest$ by $user$. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml index 4b319cbdd0..9e4c5c01c2 100644 --- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -25,12 +25,28 @@ tags: analytic_story: - XMRig automated_detection_testing: passed + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-security.log + impact: 80 kill_chain_phases: - Exploitation + message: The Telegram application has been identified enumerating local groups on + $ComputerName$ by $user$. mitre_attack_id: - T1087 + observable: + - name: user + type: User + role: + - Victim + - name: ComputerName + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -46,21 +62,5 @@ tags: - Logon_ID - Security_ID - Message - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The Telegram application has been identified enumerating local groups on $ComputerName$ by $user$. - observable: - - name: user - type: User - role: - - Victim - - name: ComputerName - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index f2e28b5fde..01042360f1 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -30,13 +30,29 @@ tags: analytic_story: - Windows Defense Evasion Tactics automated_detection_testing: passed + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Exploitation - Privilege Escalation + message: Registry values were modified to bypass UAC using Event Viewer on $dest$ + by $user$. mitre_attack_id: - T1548.002 + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -48,21 +64,5 @@ tags: - Registry.user - Registry.dest - Registry.registry_value_name - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$. - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml index 2aa2661235..c34fe1fd57 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -31,33 +31,19 @@ tags: analytic_story: - Spearphishing Attachments automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1003.002 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - process_name - - process_id - - parent_process_name - - dest - - user - - parent_process_id - security_domain: endpoint - impact: 80 confidence: 100 - # (impact * confidence)/100 - risk_score: 80 context: - Source:Endpoint - Stage:Execution - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. + mitre_attack_id: + - T1003.002 observable: - name: user type: User @@ -74,4 +60,18 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml index 72aa0d85ee..bdcaae3d33 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -35,33 +35,19 @@ tags: analytic_story: - Spearphishing Attachments automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1003.002 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - process_name - - process_id - - parent_process_name - - dest - - user - - parent_process_id - security_domain: endpoint - impact: 80 confidence: 100 - # (impact * confidence)/100 - risk_score: 80 context: - Source:Endpoint - Stage:Execution - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. + mitre_attack_id: + - T1003.002 observable: - name: user type: User @@ -78,4 +64,18 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml index 88b5d1e174..9d29dcea21 100644 --- a/detections/endpoint/excessive_attempt_to_disable_services.yml +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -28,12 +28,28 @@ tags: analytic_story: - XMRig automated_detection_testing: passed + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + impact: 80 kill_chain_phases: - Exploitation + message: An excessive amount of $process_name$ was executed on $dest$ attempting + to disable services. mitre_attack_id: - T1489 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security @@ -46,21 +62,5 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml index 8b5e3e7a08..48ec5ebe8b 100644 --- a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml +++ b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml @@ -29,12 +29,24 @@ tags: analytic_story: - meterpreter automated_detection_testing: passed + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/windows_temp_processes/logExcessiveWindowsTemp.log + impact: 80 kill_chain_phases: - Exploitation + message: Multiple processes were executed out of windows\temp within a short amount + of time on $dest$. mitre_attack_id: - T1059 + observable: + - name: dest + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -44,17 +56,5 @@ tags: - Processes.process - Processes.dest - Processes.user - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: Multiple processes were executed out of windows\temp within a short amount of time on $dest$. - observable: - - name: dest - type: Hostname - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index a0c1c000b2..bbd133d120 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -35,12 +35,28 @@ tags: analytic_story: - Windows Defense Evasion Tactics automated_detection_testing: passed + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/sc_service_start_disabled/windows-sysmon.log + impact: 80 kill_chain_phases: - Exploitation + message: An excessive amount of $process_name$ was executed on $dest$ attempting + to disable services. mitre_attack_id: - T1562.001 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security @@ -54,21 +70,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 5a9edee5cf..5d043af351 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -33,12 +33,28 @@ tags: analytic_story: - Meterpreter automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/taskhost_processes/logExcessiveTaskHost.log + impact: 80 kill_chain_phases: - Exploitation + message: An excessive amount of $process_name$ was executed on $dest$ indicative + of suspicious behavior. mitre_attack_id: - T1033 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security @@ -49,21 +65,5 @@ tags: - Processes.process_name - Processes.dest - Processes.user - security_domain: endpoint - impact: 80 - confidence: 70 - # (impact * confidence)/100 risk_score: 56 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An excessive amount of $process_name$ was executed on $dest$ indicative of suspicious behavior. - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index 4c861b9187..4177d23dab 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -30,12 +30,28 @@ tags: - XMRig - Ransomware automated_detection_testing: passed + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + impact: 80 kill_chain_phases: - Exploitation + message: An excessive amount of $process_name$ was executed on $dest$ attempting + to disable services. mitre_attack_id: - T1489 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security @@ -48,21 +64,5 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index cc5e031d21..7c26fdda67 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -28,12 +28,28 @@ tags: analytic_story: - XMRig automated_detection_testing: passed + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + impact: 80 kill_chain_phases: - Exploitation + message: An excessive amount of $process_name$ was executed on $dest$ attempting + to modify permissions. mitre_attack_id: - T1222 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security @@ -46,21 +62,5 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - security_domain: endpoint - impact: 80 - confidence: 100 - # (impact * confidence)/100 risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An excessive amount of $process_name$ was executed on $dest$ attempting to modify permissions. - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 01db1f4ebf..cbea88edfd 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -32,17 +32,30 @@ tags: - CIS 3 - CIS 7 - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Command and Control - Actions on Objectives + message: Powershell.exe running potentially malicious encodede commands on $dest$ mitre_attack_id: - T1027 nist: - PR.PT - DE.CM - PR.IP + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -55,19 +68,5 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.process_id - security_domain: endpoint - impact: 70 - confidence: 50 risk_score: 35 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Execution - - Stage:Defense Evasion - message: Powershell.exe running potentially malicious encodede commands on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim - + security_domain: endpoint diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index c8f06a3d28..b13814575a 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -35,17 +35,30 @@ tags: - CIS 3 - CIS 7 - CIS 8 + confidence: 60 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon.log + impact: 70 kill_chain_phases: - Command and Control - Actions on Objectives + message: PowerShell local execution policy bypass attempt on $dest$ mitre_attack_id: - T1059.001 nist: - PR.PT - DE.CM - PR.IP + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -58,18 +71,5 @@ tags: - Processes.process_name - Processes.user - Processes.dest - security_domain: endpoint - impact: 70 - confidence: 60 risk_score: 42 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Execution - - Stage:Defense Evasion - message: PowerShell local execution policy bypass attempt on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml index 1285935def..504b3bfe69 100644 --- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml @@ -33,17 +33,30 @@ tags: - CIS 3 - CIS 7 - CIS 8 + confidence: 60 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/obfuscated_powershell/windows-sysmon.log + impact: 70 kill_chain_phases: - Command and Control - Actions on Objectives + message: Powershell.exe running with potential obfuscated arguments on $dest$ mitre_attack_id: - T1059.001 nist: - PR.PT - DE.CM - PR.IP + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -56,18 +69,5 @@ tags: - Processes.user - Processes.parent_process_name - Processes.dest - security_domain: endpoint - impact: 70 - confidence: 60 risk_score: 42 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Execution - - Stage:Defense Evasion - message: Powershell.exe running with potential obfuscated arguments on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index b373001f67..2d8893a8f6 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -28,12 +28,23 @@ tags: - Ransomware - Revil Ransomware automated_detection_testing: passed + confidence: 90 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + impact: 60 kill_chain_phases: - Exploitation + message: Wallpaper modification on $dest$ mitre_attack_id: - T1491 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -48,17 +59,5 @@ tags: - process_guid - process_id - user_id - security_domain: endpoint - impact: 60 - confidence: 90 risk_score: 54 - context: - - Source:Endpoint - - Stage:Execution - message: Wallpaper modification on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim - \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index acbd5534ea..20dce943ae 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -31,12 +31,23 @@ tags: analytic_story: - XMRig automated_detection_testing: passed + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + impact: 40 kill_chain_phases: - Exploitation + message: Suspicious ACL permission modification on $dest$ mitre_attack_id: - T1222 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -49,16 +60,5 @@ tags: - Processes.user - Processes.process - Processes.process_id - security_domain: endpoint - impact: 40 - confidence: 80 risk_score: 32 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: Suspicious ACL permission modification on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index cb476d7d5c..86b6a2eea9 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -33,16 +33,29 @@ tags: cis20: - CIS 8 - CIS 5 + confidence: 80 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Persistence + - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/windows-sysmon.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: New print monitor added on $dest$ mitre_attack_id: - T1547.010 nist: - PR.PT - DE.CM - PR.AC + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -55,18 +68,5 @@ tags: - Registry.registry_key_name - Registry.user - Registry.registry_value_name - security_domain: endpoint - impact: 80 - confidence: 80 risk_score: 64 - context: - - Source:Endpoint - - Stage:Execution - - Stage:Persistence - - Stage:Privilege Escalation - message: New print monitor added on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim + security_domain: endpoint diff --git a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml index 043eaf3c3d..0f012a7d43 100644 --- a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -46,12 +46,24 @@ tags: analytic_story: - Active Directory Password Spraying automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log + impact: 70 kill_chain_phases: - Exploitation + message: Potential Kerberos based password spraying attack from $Client_Address$ mitre_attack_id: - T1110.003 + observable: + - name: Client_Address + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -62,17 +74,5 @@ tags: - Result_Code - Account_Name - Client_Address - security_domain: endpoint - impact: 70 - confidence: 70 risk_score: 49 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Privilege Escalation - message: Potential Kerberos based password spraying attack from $Client_Address$ - observable: - - name: Client_Address - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml index 369048bce0..9b3e79b052 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -46,12 +46,24 @@ tags: analytic_story: - Active Directory Password Spraying automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log + impact: 70 kill_chain_phases: - Exploitation + message: Potential Kerberos based password spraying attack from $Client_Address$ mitre_attack_id: - T1110.003 + observable: + - name: Client_Address + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -62,17 +74,5 @@ tags: - Result_Code - Account_Name - Client_Address - security_domain: endpoint - impact: 70 - confidence: 70 risk_score: 49 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Privilege Escalation - message: Potential Kerberos based password spraying attack from $Client_Address$ - observable: - - name: Client_Address - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml index e2e465ee76..27e10ba92f 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -50,12 +50,24 @@ tags: analytic_story: - Active Directory Password Spraying automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log + impact: 70 kill_chain_phases: - Exploitation + message: Potential NTLM based password spraying attack from $Source_Workstation$ mitre_attack_id: - T1110.003 + observable: + - name: Source_Workstation + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -66,17 +78,5 @@ tags: - action - Logon_Account - Source_Workstation - security_domain: endpoint - impact: 70 - confidence: 70 risk_score: 49 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Privilege Escalation - message: Potential NTLM based password spraying attack from $Source_Workstation$ - observable: - - name: Source_Workstation - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml index 7f91c171ed..7bbf7df8bc 100644 --- a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml +++ b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml @@ -51,12 +51,24 @@ tags: analytic_story: - Active Directory Password Spraying automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log + impact: 70 kill_chain_phases: - Exploitation + message: Potential password spraying attack from $ComputerName$ mitre_attack_id: - T1110.003 + observable: + - name: ComputerName + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -67,17 +79,5 @@ tags: - Security_ID - Account_Name - ComputerName - security_domain: endpoint - impact: 70 - confidence: 70 risk_score: 49 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Privilege Escalation - message: Potential password spraying attack from $ComputerName$ - observable: - - name: ComputerName - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml index aba2a3f188..66c44342eb 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -46,12 +46,24 @@ tags: analytic_story: - Active Directory Password Spraying automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos/windows-security.log + impact: 70 kill_chain_phases: - Exploitation + message: Potential Kerberos based password spraying attack from $Client_Address$ mitre_attack_id: - T1110.003 + observable: + - name: Client_Address + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -62,17 +74,5 @@ tags: - Result_Code - Account_Name - Client_Address - security_domain: endpoint - impact: 70 - confidence: 70 risk_score: 49 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Privilege Escalation - message: Potential Kerberos based password spraying attack from $Client_Address$ - observable: - - name: Client_Address - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml index d8df0219dc..480aaeb6b2 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -48,12 +48,24 @@ tags: analytic_story: - Active Directory Password Spraying automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log + impact: 70 kill_chain_phases: - Exploitation + message: Potential NTLM based password spraying attack from $Source_Workstation$ mitre_attack_id: - T1110.003 + observable: + - name: Source_Workstation + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -64,17 +76,5 @@ tags: - action - Logon_Account - Source_Workstation - security_domain: endpoint - impact: 70 - confidence: 70 risk_score: 49 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Privilege Escalation - message: Potential NTLM based password spraying attack from $Source_Workstation$ - observable: - - name: Source_Workstation - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml index 05707ca212..caf5d6909f 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml @@ -50,12 +50,24 @@ tags: analytic_story: - Active Directory Password Spraying automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process/windows-security.log + impact: 70 kill_chain_phases: - Exploitation + message: Potential password spraying attack from $ComputerName$ mitre_attack_id: - T1110.003 + observable: + - name: ComputerName + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -68,17 +80,5 @@ tags: - Security_ID - Account_Name - ComputerName - security_domain: endpoint - impact: 70 - confidence: 70 risk_score: 49 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Privilege Escalation - message: Potential password spraying attack from $ComputerName$ - observable: - - name: ComputerName - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml index 3b3217e809..0dab1fc5aa 100644 --- a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml +++ b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml @@ -49,12 +49,24 @@ tags: analytic_story: - Active Directory Password Spraying automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log + impact: 70 kill_chain_phases: - Exploitation + message: Potential password spraying attack on $ComputerName$ mitre_attack_id: - T1110.003 + observable: + - name: ComputerName + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -67,17 +79,5 @@ tags: - Account_Name - ComputerName - Source_Network_Address - security_domain: endpoint - impact: 70 - confidence: 70 risk_score: 49 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Privilege Escalation - message: Potential password spraying attack on $ComputerName$ - observable: - - name: ComputerName - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml index eed89582c7..b95183fa98 100644 --- a/detections/endpoint/nishang_powershelltcponeline.yml +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -33,12 +33,24 @@ tags: analytic_story: - HAFNIUM Group automated_detection_testing: passed + confidence: 60 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Command and Control dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$ mitre_attack_id: - T1059.001 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -53,17 +65,5 @@ tags: - Processes.process_name - Processes.process_id - Processes.parent_process_id - security_domain: endpoint - impact: 70 - confidence: 60 risk_score: 42 - context: - - Source:Endpoint - - Stage:Execution - - Stage:Command and Control - message: Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index 85c2e07fed..0d28c474ab 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -38,15 +38,26 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Discovery dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log + impact: 30 kill_chain_phases: - Exploitation + message: Domain trust discovery execution on $dest$ mitre_attack_id: - T1482 nist: - PR.PT - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -60,16 +71,5 @@ tags: - Processes.parent_process - Processes.process_id - Processes.parent_process_id - security_domain: endpoint - impact: 30 - confidence: 50 risk_score: 15 - context: - - Source:Endpoint - - Stage:Discovery - message: Domain trust discovery execution on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index 71e755a0de..189cd57637 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -43,14 +43,25 @@ tags: cis20: - CIS 8 - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + impact: 100 kill_chain_phases: - Actions on Objectives + message: Active Directory NTDS export on $dest$ mitre_attack_id: - T1003.003 nist: - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -64,16 +75,5 @@ tags: - Processes.parent_process - Processes.process_id - Processes.parent_process_id - security_domain: endpoint - impact: 100 - confidence: 50 risk_score: 50 - context: - - Source:Endpoint - - Stage:Credential Access - message: Active Directory NTDS export on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index 37e7ac8c83..c55864fce5 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -30,12 +30,23 @@ tags: - Spearphishing Attachments - Trickbot automated_detection_testing: passed + confidence: 90 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Office application spawning rundll32.exe on $dest$ mitre_attack_id: - T1566.001 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -48,16 +59,5 @@ tags: - Processes.dest - Processes.user - Processes.process_id - security_domain: endpoint - impact: 70 - confidence: 90 risk_score: 63 - context: - - Source:Endpoint - - Stage:Execution - message: Office application spawning rundll32.exe on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index c135a66a39..415d8030a5 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -36,12 +36,23 @@ tags: analytic_story: - Spearphishing Attachments automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Office document creating a schedule task on $dest$ mitre_attack_id: - T1566.001 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -56,16 +67,5 @@ tags: - ProcessId - ProcessGuid - _time - security_domain: endpoint - impact: 70 - confidence: 70 risk_score: 49 - context: - - Source:Endpoint - - Stage:Execution - message: Office document creating a schedule task on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 6fa3f06622..79d24dedce 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -30,12 +30,23 @@ tags: - Spearphishing Attachments - Trickbot automated_detection_testing: passed + confidence: 50 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Office document executing a macro on $dest$ mitre_attack_id: - T1566.001 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -50,16 +61,5 @@ tags: - ProcessId - ProcessGuid - _time - security_domain: endpoint - impact: 70 - confidence: 50 risk_score: 35 - context: - - Source:Endpoint - - Stage:Execution - message: Office document executing a macro on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml index 42fd4c563c..e942eb3aaa 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -28,12 +28,23 @@ tags: analytic_story: - Spearphishing Attachments automated_detection_testing: passed + confidence: 50 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Office document spawning suspicious child process on $dest$ mitre_attack_id: - T1566.001 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -49,16 +60,5 @@ tags: - ProcessGuid - Computer - EventCode - security_domain: endpoint - impact: 70 - confidence: 50 risk_score: 35 - context: - - Source:Endpoint - - Stage:Execution - message: Office document spawning suspicious child process on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml index e3e70cf567..f9f09d2ea7 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml @@ -26,7 +26,8 @@ search: '`powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]: how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: False positives should be limited as day to day scripts do not use this method. +known_false_positives: False positives should be limited as day to day scripts do + not use this method. references: - https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0 - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml index ab0968e1e3..43010b9405 100644 --- a/detections/endpoint/start_up_during_safe_mode_boot.yml +++ b/detections/endpoint/start_up_during_safe_mode_boot.yml @@ -28,10 +28,17 @@ tags: analytic_story: - Ransomware automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Persistence dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log + impact: 60 kill_chain_phases: - Exploitation + message: Safeboot registry $Registry.registry_path$ was added or modified with a + new value $Registry.registry_value_name$ mitre_attack_id: - T1547.001 product: @@ -44,11 +51,5 @@ tags: - Registry.registry_key_name - Registry.registry_value_name - Registry.dest - security_domain: endpoint - impact: 60 - confidence: 70 risk_score: 42 - context: - - Source:Endpoint - - Stage:Persistence - message: Safeboot registry $Registry.registry_path$ was added or modified with a new value $Registry.registry_value_name$ + security_domain: endpoint diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml index a2cc5707c3..98c5ca05e6 100644 --- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml @@ -29,12 +29,30 @@ tags: analytic_story: - Cobalt Strike automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Suspicious dllhost.exe process with no command line arguments executed + on $dest$ by $user$ mitre_attack_id: - T1055 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -50,22 +68,5 @@ tags: - ParentImage - ParentCommandLine - process_path - security_domain: endpoint - impact: 70 - confidence: 70 risk_score: 49 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Execution - - Stage:Defense Evasion - message: Suspicious dllhost.exe process with no command line arguments executed on $dest$ by $user$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim + security_domain: endpoint diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml index 76d3112767..d2add93de2 100644 --- a/detections/endpoint/suspicious_driver_loaded_path.yml +++ b/detections/endpoint/suspicious_driver_loaded_path.yml @@ -31,12 +31,28 @@ tags: analytic_story: - XMRig automated_detection_testing: passed + confidence: 90 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Suspicious driver $ImageLoaded$ on $Computer$ mitre_attack_id: - T1543.003 + observable: + - name: Computer + type: Endpoint + role: + - Victim + - name: ImageLoaded + type: File Name + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -49,21 +65,5 @@ tags: - IMPHASH - Signature - Signed - security_domain: endpoint - impact: 70 - confidence: 90 risk_score: 63 - context: - - Source:Endpoint - - Stage:Execution - - Stage:Defense Evasion - message: Suspicious driver $ImageLoaded$ on $Computer$ - observable: - - name: Computer - type: Endpoint - role: - - Victim - - name: ImageLoaded - type: File Name - role: - - Attacker + security_domain: endpoint diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml index 3ae5c3e631..050ebd3e93 100644 --- a/detections/endpoint/suspicious_event_log_service_behavior.yml +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -35,10 +35,16 @@ tags: - CIS 3 - CIS 5 - CIS 6 + confidence: 30 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-security.log + impact: 30 kill_chain_phases: - Actions on Objectives + message: The Windows Event Log Service shutdown on $ComputerName$ mitre_attack_id: - T1070.001 nist: @@ -47,6 +53,11 @@ tags: - PR.AC - PR.AT - DE.AE + observable: + - name: ComputerName + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -55,16 +66,5 @@ tags: - _time - EventCode - dest - security_domain: endpoint - impact: 30 - confidence: 30 risk_score: 9 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: The Windows Event Log Service shutdown on $ComputerName$ - observable: - - name: ComputerName - type: Endpoint - role: - - Victim + security_domain: endpoint diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml index 5f1278ec71..3ebb593bd0 100644 --- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml @@ -29,12 +29,30 @@ tags: analytic_story: - Cobalt Strike automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Suspicious gpupdate.exe process with no command line arguments executed + on $dest$ by $user$ mitre_attack_id: - T1055 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -50,22 +68,5 @@ tags: - ParentImage - ParentCommandLine - process_path - security_domain: endpoint - impact: 70 - confidence: 70 risk_score: 49 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Execution - - Stage:Defense Evasion - message: Suspicious gpupdate.exe process with no command line arguments executed on $dest$ by $user$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim + security_domain: endpoint diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml index 169944bc4c..fd7170c6e8 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml @@ -34,16 +34,34 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 90 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Suspicious renamed microsoft.workflow.compiler.exe binary ran on $dest$ + by $user$ mitre_attack_id: - T1127 - T1036.003 nist: - PR.PT - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -58,22 +76,5 @@ tags: - parent_process_name - process_path - CommandLine - security_domain: endpoint - impact: 70 - confidence: 90 risk_score: 63 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Execution - - Stage:Defense Evasion - message: Suspicious renamed microsoft.workflow.compiler.exe binary ran on $dest$ by $user$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim + security_domain: endpoint diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml index 2d5d55ae42..4523b56a1e 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml @@ -30,15 +30,32 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Defense Evasion + - Stage:Execution + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$ mitre_attack_id: - T1127 nist: - PR.PT - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -50,22 +67,5 @@ tags: - Processes.dest - Processes.parent_process - Processes.user - security_domain: endpoint - impact: 70 - confidence: 50 risk_score: 35 - context: - - Source:Endpoint - - Stage:Defense Evasion - - Stage:Execution - - Stage:Defense Evasion - message: Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim + security_domain: endpoint diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml index 3d90571ca5..b6e79859b4 100644 --- a/detections/endpoint/suspicious_msbuild_path.yml +++ b/detections/endpoint/suspicious_msbuild_path.yml @@ -36,16 +36,33 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + - Stage:Execution + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$ mitre_attack_id: - T1127.001 - T1036.003 nist: - PR.PT - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -58,22 +75,5 @@ tags: - Processes.dest - Processes.parent_process - Processes.user - security_domain: endpoint - impact: 70 - confidence: 70 risk_score: 49 - context: - - Source:Endpoint - - Stage:Defense Evasion - - Stage:Execution - - Stage:Defense Evasion - message: Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim + security_domain: endpoint diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml index 4523586aeb..29d7a24179 100644 --- a/detections/endpoint/suspicious_msbuild_rename.yml +++ b/detections/endpoint/suspicious_msbuild_rename.yml @@ -33,16 +33,33 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 90 + context: + - Source:Endpoint + - Stage:Defense Evasion + - Stage:Execution + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Suspicious renamed msbuild.exe binary ran on $dest$ by $user$ mitre_attack_id: - T1127.001 - T1036.003 nist: - PR.PT - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -57,22 +74,5 @@ tags: - parent_process_name - process_path - CommandLine - security_domain: endpoint - impact: 70 - confidence: 90 risk_score: 63 - context: - - Source:Endpoint - - Stage:Defense Evasion - - Stage:Execution - - Stage:Defense Evasion - message: Suspicious renamed msbuild.exe binary ran on $dest$ by $user$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml index d66342e2c8..e246cf6ebd 100644 --- a/detections/endpoint/suspicious_msbuild_spawn.yml +++ b/detections/endpoint/suspicious_msbuild_spawn.yml @@ -34,15 +34,31 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 60 + context: + - Source:Endpoint + - Stage:Defense Evasion + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Suspicious msbuild.exe process executed on $dest$ by $user$ mitre_attack_id: - T1127.001 nist: - PR.PT - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -55,21 +71,5 @@ tags: - Processes.dest - Processes.parent_process - Processes.user - security_domain: endpoint - impact: 70 - confidence: 60 risk_score: 42 - context: - - Source:Endpoint - - Stage:Defense Evasion - - Stage:Execution - message: Suspicious msbuild.exe process executed on $dest$ by $user$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml index a397e3318a..b008df678b 100644 --- a/detections/endpoint/suspicious_mshta_spawn.yml +++ b/detections/endpoint/suspicious_mshta_spawn.yml @@ -32,15 +32,27 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 60 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: mshta.exe spawned by wmiprvse.exe on $dest$ mitre_attack_id: - T1218.005 nist: - PR.PT - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -53,17 +65,5 @@ tags: - Processes.dest - Processes.parent_process - Processes.user - security_domain: endpoint - impact: 70 - confidence: 60 risk_score: 42 - context: - - Source:Endpoint - - Stage:Execution - - Stage:Defense Evasion - message: mshta.exe spawned by wmiprvse.exe on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 375ca67f30..d22ac32844 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -33,12 +33,29 @@ tags: analytic_story: - XMRig automated_detection_testing: passed + confidence: 50 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Initial Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Suspicioues process $Processes.process_path.file_path$ running from suspicious + location mitre_attack_id: - T1543 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: Processes.process_path.file_path + type: File Name + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -52,21 +69,5 @@ tags: - Processes.process_path - Processes.dest - Processes.user - security_domain: endpoint - impact: 70 - confidence: 50 risk_score: 35 - context: - - Source:Endpoint - - Stage:Execution - - Stage:Initial Access - message: Suspicioues process $Processes.process_path.file_path$ running from suspicious location - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: Processes.process_path.file_path - type: File Name - role: - - Attacker \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index 56f6887fad..4a4a8fe4d1 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -37,14 +37,31 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Initial Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Actions on Objectives + message: Suspicious $Processes.process_path.file_path$ process running with an uncommon + parent process $Processes.parent_process_name$ mitre_attack_id: - T1112 nist: - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: Processes.process_path.file_path + type: File Name + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -58,21 +75,5 @@ tags: - Processes.dest - Processes.process_id - Processes.parent_process_id - security_domain: endpoint - impact: 70 - confidence: 50 risk_score: 35 - context: - - Source:Endpoint - - Stage:Execution - - Stage:Initial Access - message: Suspicious $Processes.process_path.file_path$ process running with an uncommon parent process $Processes.parent_process_name$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: Processes.process_path.file_path - type: File Name - role: - - Attacker \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index d500f88015..b1d1014167 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -38,14 +38,31 @@ tags: cis20: - CIS 8 - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Initial Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Actions on Objectives + message: Suspicious $Processes.process_path.file_path$ process potentially loading + malicious code mitre_attack_id: - T1218.010 nist: - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: Processes.process_path.file_path + type: File Name + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -60,21 +77,5 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - security_domain: endpoint - impact: 70 - confidence: 50 risk_score: 35 - context: - - Source:Endpoint - - Stage:Execution - - Stage:Initial Access - message: Suspicious $Processes.process_path.file_path$ process potentially loading malicious code - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: Processes.process_path.file_path - type: File Name - role: - - Attacker + security_domain: endpoint diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index b6bcbd5ac7..3c08f9236f 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -40,15 +40,32 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Initial Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Actions on Objectives + message: $Processes.process_path.file_path$ process potentially loading malicious + code mitre_attack_id: - T1218.011 nist: - PR.PT - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: Processes.process_path.file_path + type: File Name + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -62,21 +79,5 @@ tags: - Processes.parent_process - Processes.process_id - Processes.parent_process_id - security_domain: endpoint - impact: 70 - confidence: 50 risk_score: 35 - context: - - Source:Endpoint - - Stage:Execution - - Stage:Initial Access - message: $Processes.process_path.file_path$ process potentially loading malicious code - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: Processes.process_path.file_path - type: File Name - role: - - Attacker + security_domain: endpoint diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml index ccebc6c91f..0a3a03e50f 100644 --- a/detections/endpoint/suspicious_rundll32_rename.yml +++ b/detections/endpoint/suspicious_rundll32_rename.yml @@ -34,16 +34,33 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 90 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Initial Access + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Actions on Objectives + message: Suspicious renamed rundll32.exe binary ran on $dest$ by $user$ mitre_attack_id: - T1218.011 - T1036.003 nist: - PR.PT - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -58,22 +75,5 @@ tags: - parent_process_name - process_path - CommandLine - security_domain: endpoint - impact: 70 - confidence: 90 risk_score: 63 - context: - - Source:Endpoint - - Stage:Execution - - Stage:Initial Access - - Stage:Defense Evasion - message: Suspicious renamed rundll32.exe binary ran on $dest$ by $user$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index 22fb7794c3..a6f99d08af 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -41,15 +41,32 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Initial Access + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Actions on Objectives + message: rundll32.exe running with suspicious parameters on $dest$ mitre_attack_id: - T1218.011 nist: - PR.PT - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -63,22 +80,5 @@ tags: - Processes.parent_process - Processes.process_id - Processes.parent_process_id - security_domain: endpoint - impact: 70 - confidence: 50 risk_score: 35 - context: - - Source:Endpoint - - Stage:Execution - - Stage:Initial Access - - Stage:Defense Evasion - message: rundll32.exe running with suspicious parameters on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml index c7d24eecd6..f7ea89732a 100644 --- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml @@ -36,15 +36,33 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 70 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Initial Access + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Actions on Objectives + message: Suspicious rundll32.exe process with no command line arguments executed + on $dest$ by $user$ mitre_attack_id: - T1218.011 nist: - PR.PT - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -60,23 +78,5 @@ tags: - ParentImage - ParentCommandLine - process_path - security_domain: endpoint - impact: 70 - confidence: 70 risk_score: 49 - context: - - Source:Endpoint - - Stage:Execution - - Stage:Initial Access - - Stage:Defense Evasion - message: Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim - + security_domain: endpoint diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 963791bb7e..eb1ce4d5b1 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -32,13 +32,30 @@ tags: - Ryuk Ransomware - Windows Persistence Techniques automated_detection_testing: passed + confidence: 50 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Initial Access + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation - Privilege Escalation + message: Suspicious scheduled task registered on $dest$ mitre_attack_id: - T1053.005 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -53,22 +70,5 @@ tags: - Processes.process_name - Processes.process_id - Processes.parent_process_id - security_domain: endpoint - impact: 70 - confidence: 50 risk_score: 35 - context: - - Source:Endpoint - - Stage:Execution - - Stage:Initial Access - - Stage:Defense Evasion - message: Suspicious scheduled task registered on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim + security_domain: endpoint diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml index dc7f7d5235..4f99ad274f 100644 --- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml @@ -29,12 +29,30 @@ tags: analytic_story: - Cobalt Strike automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Initial Access + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Suspicious searchprotocolhost.exe process with no command line arguments + executed on $dest$ by $user$ mitre_attack_id: - T1055 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -50,22 +68,5 @@ tags: - ParentImage - ParentCommandLine - process_path - security_domain: endpoint - impact: 70 - confidence: 70 risk_score: 49 - context: - - Source:Endpoint - - Stage:Execution - - Stage:Initial Access - - Stage:Defense Evasion - message: Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 24e2394a5f..825d9d06a7 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -35,10 +35,16 @@ tags: - CIS 3 - CIS 5 - CIS 6 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-sysmon.log + impact: 40 kill_chain_phases: - Actions on Objectives + message: Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ mitre_attack_id: - T1070.001 nist: @@ -48,6 +54,15 @@ tags: - PR.AC - PR.AT - DE.AE + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -59,20 +74,5 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - security_domain: endpoint - impact: 40 - confidence: 70 risk_score: 28 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Victim + security_domain: endpoint diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index b06b7e6346..c6f48ee3e2 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -30,12 +30,27 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/write_to_recycle_bin/windows-sysmon.log + impact: 40 + message: Suspicious writes to windows Recycle Bin process $Processes.process_name$ mitre_attack_id: - T1036 nist: - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: Processes.process_name + type: Process + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -51,20 +66,5 @@ tags: - Processes.parent_process_name - Processes.process_id - Processes.dest - security_domain: endpoint - impact: 40 - confidence: 70 risk_score: 28 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: Suspicious writes to windows Recycle Bin process $Processes.process_name$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: Processes.process_name - type: Process - role: - - Attacker \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index 27cae2af99..d3009e3bcb 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -30,14 +30,30 @@ tags: cis20: - CIS 6 - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Recon + - Stage:Discovery dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1082/atomic_red_team/windows-sysmon.log + impact: 30 kill_chain_phases: - Actions on Objectives + message: Potential system information discovery behavior on $dest$ by $User$ mitre_attack_id: - T1082 nist: - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -48,21 +64,5 @@ tags: - Processes.user - Processes.process_name - Processes.dest - security_domain: endpoint - impact: 30 - confidence: 50 risk_score: 15 - context: - - Source:Endpoint - - Stage:Recon - - Stage:Discovery - message: Potential system information discovery behavior on $dest$ by $User$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: User - type: User - role: - - Attacker + security_domain: endpoint diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 8ebd880f4c..59ea171994 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -41,15 +41,31 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 70 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Actions on Objectives + message: System process running from unexpected location on $dest$ mitre_attack_id: - T1036.003 nist: - PR.PT - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: Processes.process_name + type: Process + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -63,21 +79,5 @@ tags: - Processes.process_id - Processes.parent_process_name - Processes.process_hash - security_domain: endpoint - impact: 70 - confidence: 70 risk_score: 49 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Execution - message: System process running from unexpected location on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: Processes.process_name - type: Process - role: - - Attacker \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/trickbot_named_pipe.yml b/detections/endpoint/trickbot_named_pipe.yml index 4967bbf04e..7c8c4cb3e1 100644 --- a/detections/endpoint/trickbot_named_pipe.yml +++ b/detections/endpoint/trickbot_named_pipe.yml @@ -24,12 +24,28 @@ tags: analytic_story: - Trickbot automated_detection_testing: passed + confidence: 60 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Possible Trickbot namedpipe created on $Computer$ by $Image$ mitre_attack_id: - T1055 + observable: + - name: Computer + type: Endpoint + role: + - Victim + - name: Image + type: Process + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -43,21 +59,5 @@ tags: - signature - Image - process_id - security_domain: endpoint - impact: 70 - confidence: 60 risk_score: 42 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Execution - message: Possible Trickbot namedpipe created on $Computer$ by $Image$ - observable: - - name: Computer - type: Endpoint - role: - - Victim - - name: Image - type: Process - role: - - Attacker \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/endpoint/unified_messaging_service_spawning_a_process.yml index e8a2553511..788b114531 100644 --- a/detections/endpoint/unified_messaging_service_spawning_a_process.yml +++ b/detections/endpoint/unified_messaging_service_spawning_a_process.yml @@ -36,12 +36,24 @@ tags: analytic_story: - HAFNIUM Group automated_detection_testing: passed + confidence: 80 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_umservices.log + impact: 70 kill_chain_phases: - Exploitation + message: Possible CVE-2021-26857 exploitation on $dest$ mitre_attack_id: - T1190 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -55,17 +67,5 @@ tags: - Processes.parent_process - Processes.process_id - Processes.parent_process_id - security_domain: endpoint - impact: 70 - confidence: 80 risk_score: 56 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Execution - message: Possible CVE-2021-26857 exploitation on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index b134ca2256..0d870ba297 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -31,14 +31,25 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 90 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log + impact: 50 kill_chain_phases: - Actions on Objectives + message: Possible Sysmon filter driver unloading on $dest$ mitre_attack_id: - T1562.001 nist: - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -51,16 +62,5 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - security_domain: endpoint - impact: 50 - confidence: 90 risk_score: 45 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: Possible Sysmon filter driver unloading on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/unloading_amsi_via_reflection.yml b/detections/endpoint/unloading_amsi_via_reflection.yml index ac6a13eb39..279a1297ac 100644 --- a/detections/endpoint/unloading_amsi_via_reflection.yml +++ b/detections/endpoint/unloading_amsi_via_reflection.yml @@ -37,12 +37,24 @@ tags: analytic_story: - Malicious PowerShell automated_detection_testing: passed + confidence: 70 + context: + - Source:Endpoint + - Stage:Execution + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log + impact: 70 kill_chain_phases: - Exploitation + message: Possible AMSI Unloading via Reflection using PowerShell on $ComputerName$ mitre_attack_id: - T1562 + observable: + - name: ComputerName + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -54,17 +66,5 @@ tags: - ComputerName - User - EventCode - security_domain: endpoint - impact: 70 - confidence: 70 risk_score: 49 - context: - - Source:Endpoint - - Stage:Execution - - Stage:Defense Evasion - message: Possible AMSI Unloading via Reflection using PowerShell on $ComputerName$ - observable: - - name: ComputerName - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml index b522a0a190..5473f8867f 100644 --- a/detections/endpoint/unusually_long_command_line.yml +++ b/detections/endpoint/unusually_long_command_line.yml @@ -31,13 +31,28 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 60 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon.log + impact: 70 kill_chain_phases: - Actions on Objectives + message: Unusually long command line $Processes.process_name$ on $dest$ nist: - PR.PT - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: Processes.process_name + type: Process + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -48,20 +63,5 @@ tags: - Processes.dest - Processes.process_name - Processes.process - security_domain: endpoint - impact: 70 - confidence: 60 risk_score: 42 - context: - - Source:Endpoint - - Stage:Execution - message: Unusually long command line $Processes.process_name$ on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: Processes.process_name - type: Process - role: - - Attacker + security_domain: endpoint diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml index 842ff33397..ea9fa61661 100644 --- a/detections/endpoint/usn_journal_deletion.yml +++ b/detections/endpoint/usn_journal_deletion.yml @@ -33,10 +33,16 @@ tags: - CIS 6 - CIS 8 - CIS 10 + confidence: 90 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/atomic_red_team/windows-sysmon.log + impact: 50 kill_chain_phases: - Actions on Objectives + message: Possible USN journal deletion on $dest$ mitre_attack_id: - T1070 nist: @@ -45,6 +51,11 @@ tags: - DE.AE - DE.DP - PR.IP + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -57,16 +68,5 @@ tags: - Processes.user - Processes.parent_process_name - Processes.dest - security_domain: endpoint - impact: 50 - confidence: 90 risk_score: 45 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: Possible USN journal deletion on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index 65503c28f9..ad9d5ff8bb 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -32,12 +32,24 @@ tags: analytic_story: - HAFNIUM Group automated_detection_testing: passed + confidence: 80 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Possible Web Shell execution on $dest$ mitre_attack_id: - T1505.003 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -49,17 +61,5 @@ tags: - Processes.dest - Processes.user - Processes.parent_process - security_domain: endpoint - impact: 70 - confidence: 80 risk_score: 56 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Execution - message: Possible Web Shell execution on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml index c1d0119b8a..eadc118998 100644 --- a/detections/endpoint/wbadmin_delete_system_backups.yml +++ b/detections/endpoint/wbadmin_delete_system_backups.yml @@ -32,14 +32,25 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 50 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + impact: 30 kill_chain_phases: - Actions on Objectives + message: System backups deletion on $dest$ mitre_attack_id: - T1490 nist: - PR.IP + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -51,16 +62,5 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - security_domain: endpoint - impact: 30 - confidence: 50 risk_score: 15 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: System backups deletion on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml index bdc2e8bad2..73231c697b 100644 --- a/detections/endpoint/wbemprox_com_object_execution.yml +++ b/detections/endpoint/wbemprox_com_object_execution.yml @@ -27,12 +27,23 @@ tags: - Ransomware - Revil Ransomware automated_detection_testing: passed + confidence: 50 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf2/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Suspicious COM Object Execution on $Computer$ mitre_attack_id: - T1218.003 + observable: + - name: Computer + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -48,16 +59,5 @@ tags: - ProcessId - Hashes - IMPHASH - security_domain: endpoint - impact: 70 - confidence: 50 risk_score: 35 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: Suspicious COM Object Execution on $Computer$ - observable: - - name: Computer - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml index 48f4d5502d..94eea38891 100644 --- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml +++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml @@ -32,12 +32,24 @@ tags: analytic_story: - Trickbot automated_detection_testing: passed + confidence: 80 + context: + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Wermgr.exe process connecting IP location web services on $ComputerName$ mitre_attack_id: - T1590.005 + observable: + - name: ComputerName + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -52,17 +64,5 @@ tags: - QueryResults - Computer - EventCode - security_domain: endpoint - impact: 70 - confidence: 80 risk_score: 56 - context: - - Source:Endpoint - - Stage:Initial Access - - Stage:Execution - message: Wermgr.exe process connecting IP location web services on $ComputerName$ - observable: - - name: ComputerName - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml index 2829132abe..0ecf20ff5d 100644 --- a/detections/endpoint/wermgr_process_create_executable_file.yml +++ b/detections/endpoint/wermgr_process_create_executable_file.yml @@ -28,12 +28,23 @@ tags: analytic_story: - Trickbot automated_detection_testing: passed + confidence: 80 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Wermgr.exe writing executable files on $dest$ mitre_attack_id: - T1027 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -46,16 +57,5 @@ tags: - dest - EventCode - ProcessId - security_domain: endpoint - impact: 70 - confidence: 80 risk_score: 56 - context: - - Source:Endpoint - - Stage:Execution - message: Wermgr.exe writing executable files on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml index 25396583e0..8a2a5def5f 100644 --- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml +++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml @@ -29,12 +29,23 @@ tags: analytic_story: - Trickbot automated_detection_testing: passed + confidence: 80 + context: + - Source:Endpoint + - Stage:Execution dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + impact: 70 kill_chain_phases: - Exploitation + message: Wermgr.exe spawning suspicious processes on $dest$ mitre_attack_id: - T1059 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -49,16 +60,5 @@ tags: - Processes.process_guid - Processes.dest - Processes.user - security_domain: endpoint - impact: 70 - confidence: 80 risk_score: 56 - context: - - Source:Endpoint - - Stage:Execution - message: Wermgr.exe spawning suspicious processes on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index 8182169765..55cabb306f 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -34,15 +34,26 @@ tags: automated_detection_testing: passed cis20: - CIS 8 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log + impact: 30 kill_chain_phases: - Delivery + message: Windows DisableAntiSpyware registry key set to 'disabled' on $dest$ mitre_attack_id: - T1562.001 nist: - PR.PT - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -54,16 +65,5 @@ tags: - Registry.dest - Registry.user - Registry.registry_path - security_domain: endpoint - impact: 30 - confidence: 80 risk_score: 24 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: Windows DisableAntiSpyware registry key set to 'disabled' on $dest$ - observable: - - name: dest - type: Endpoint - role: - - Victim \ No newline at end of file + security_domain: endpoint diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index 993ffd4e34..043ae143d5 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T17:26:56 UTC +# On Date: 2021-07-20T20:51:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -225,7 +225,7 @@ id = 5a6f6849-1a26-4fae-aa05-fa730556eeb6 version = 1 reference = ["https://www.hhs.gov/sites/default/files/analyst-note-cl0p-tlp-white.pdf", "https://securityaffairs.co/wordpress/115250/data-breach/qualys-clop-ransomware.html", "https://www.darkreading.com/attacks-breaches/qualys-is-the-latest-victim-of-accellion-data-breach/d/d-id/1340323"] detection_searches = ["ESCU - Clop Common Exec Parameter - Rule", "ESCU - Clop Ransomware Known Service Name - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Create Service In Suspicious File Path - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - High File Deletion Frequency - Rule", "ESCU - High Process Termination Frequency - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - Resize ShadowStorage volume - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule"] -mappings = {"cis20": ["CIS 10", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Obfuscation", "Privilege Escalation"], "mitre_attack": ["T1003.002", "T1070.001", "T1204", "T1485", "T1486", "T1490", "T1543", "T1569.001", "T1569.002"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} +mappings = {"cis20": ["CIS 10", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Obfuscation", "Privilege Escalation"], "mitre_attack": ["T1003.002", "T1070.001", "T1204", "T1485", "T1486", "T1490", "T1543", "T1569.002"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = [] support_searches = [] data_models = ["Endpoint"] @@ -1535,7 +1535,7 @@ id = 16f93769-8342-44c0-9b1d-f131937cce8e version = 1 reference = ["https://en.wikipedia.org/wiki/Trickbot", "https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/"] detection_searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Powershell Remote Thread To Known Windows Process - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Trickbot Named Pipe - Rule", "ESCU - Wermgr Process Connecting To IP Check Web Services - Rule", "ESCU - Wermgr Process Create Executable File - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule", "ESCU - Write Executable in SMB Share - Rule"] -mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Lateral Movement"], "mitre_attack": ["T1021.002", "T1027", "T1053", "T1055", "T1059", "T1087.002", "T1218.011", "T1562.001", "T1566.001", "T1590.005"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} +mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Lateral Movement", "Reconnaissance"], "mitre_attack": ["T1021.002", "T1027", "T1053", "T1055", "T1059", "T1087.002", "T1218.011", "T1562.001", "T1566.001", "T1590.005"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} investigative_searches = [] support_searches = [] data_models = ["Endpoint"] diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index 163867b19a..ad16c04056 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T17:26:56 UTC +# On Date: 2021-07-20T20:51:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -1551,7 +1551,7 @@ asset_type = confidence = medium explanation = this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002"]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} known_false_positives = admin or power user may used this series of command. providing_technologies = [] @@ -1569,7 +1569,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +explanation = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} known_false_positives = network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered. @@ -1579,7 +1579,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = This search is to detect suspicious powershell command to allow inbound traffic in specific local port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +explanation = The following analytic identifies suspicious PowerShell command to allow inbound traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} known_false_positives = administrator may allow inbound traffic in certain network or machine. @@ -1599,7 +1599,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = this search is to detect a potential privilege escalation attempt to do malicious task. This registry modification is designed to allows the Consent Admin to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. +explanation = This analytic identifies a potential privilege escalation attempt to perform malicious task. This registry modification is designed to allow the `Consent Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"]} known_false_positives = unknown @@ -1790,7 +1790,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. -how_to_implement = +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. annotations = {"kill_chain_phases": ["Installation"]} known_false_positives = Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services. providing_technologies = [] @@ -1809,8 +1809,8 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files. -how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +explanation = this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]} known_false_positives = administrator may execute this app to manage disk providing_technologies = [] @@ -1832,7 +1832,7 @@ type = detection asset_type = confidence = medium explanation = The following analytics are designed to identifies some CLOP ransomware variant that using arguments to execute its main code or feature of its code. In this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files in network shares and if it is "temp.dat", it will try to read from some stream pipe or file start encrypting files within the infected local machines. This technique can be also identified as an anti-sandbox technique to make its code non-responsive since it is waiting for some parameter to execute properly. -how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. annotations = {"kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1204"]} known_false_positives = Operators can execute third party tools using these parameters. providing_technologies = [] @@ -2022,7 +2022,7 @@ asset_type = confidence = medium explanation = This detection is to identify a creation of "user mode service" where the service file path is located in non-common service folder in windows. how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. -annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.001", "T1569.002"]} +annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"]} known_false_positives = unknown providing_technologies = [] @@ -2070,7 +2070,7 @@ providing_technologies = [] type = detection asset_type = Windows confidence = medium -explanation = Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. +explanation = Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} known_false_positives = Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. @@ -2391,7 +2391,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -3229,7 +3229,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = This search is to identifies modification of registry to disable the regedit or registry tools of windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. +explanation = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} known_false_positives = admin may disable this application for non technical user. @@ -3239,7 +3239,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = The following search is to idetifies a modification in registry to prevent the user seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. +explanation = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001"]} known_false_positives = unknown @@ -4770,7 +4770,7 @@ This analytic identifies the use of PowerShell loading .net assembly via reflect During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} -known_false_positives = False positives will be limited to +known_false_positives = False positives should be limited as day to day scripts do not use this method. providing_technologies = [] [savedsearch://ESCU - PowerShell Start-BitsTransfer - Rule] diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index dec34147d6..0c4dc531e1 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 34688 +build = 34790 [triggers] reload.analytic_stories = simple diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 9995387a76..0dc3306f84 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T17:26:55 UTC +# On Date: 2021-07-20T20:51:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 0b5f3e15bf..b5c21eac0a 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T17:26:56 UTC +# On Date: 2021-07-20T20:51:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 82a8cdb665..669cd17fd5 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T17:26:55 UTC +# On Date: 2021-07-20T20:51:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -233,8 +233,8 @@ action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. -action.escu.creation_date = 2021-03-02 -action.escu.modification_date = 2021-03-02 +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 action.escu.confidence = high action.escu.full_search_name = ESCU - AWS CreateAccessKey - Rule action.escu.search_type = detection @@ -264,7 +264,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success| search userName!=requestParameters.userName | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_createaccesskey_filter` +search = `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success| search userIdentity.userName!=requestParameters.userName | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_createaccesskey_filter` [ESCU - AWS CreateLoginProfile - Rule] action.escu = 0 @@ -275,8 +275,8 @@ action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user. -action.escu.creation_date = 2021-03-02 -action.escu.modification_date = 2021-03-02 +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 action.escu.confidence = high action.escu.full_search_name = ESCU - AWS CreateLoginProfile - Rule action.escu.search_type = detection @@ -306,7 +306,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `cloudtrail` eventName = CreateLoginProfile | rename requestParameters.userName as new_login_profile | table src_ip eventName new_login_profile userName | join new_login_profile src_ip [| search `cloudtrail` eventName = ConsoleLogin | rename userName as new_login_profile | stats count values(eventName) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn new_login_profile src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`] | `aws_createloginprofile_filter` +search = `cloudtrail` eventName = CreateLoginProfile | rename requestParameters.userName as new_login_profile | table src_ip eventName new_login_profile userIdentity.userName | join new_login_profile src_ip [| search `cloudtrail` eventName = ConsoleLogin | rename userIdentity.userName as new_login_profile | stats count values(eventName) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn new_login_profile src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`] | `aws_createloginprofile_filter` [ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule] action.escu = 0 @@ -945,8 +945,8 @@ action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. -action.escu.creation_date = 2021-03-02 -action.escu.modification_date = 2021-03-02 +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 action.escu.confidence = high action.escu.full_search_name = ESCU - AWS UpdateLoginProfile - Rule action.escu.search_type = detection @@ -976,7 +976,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success| search userName!=requestParameters.userName | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userName user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter` +search = `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success| search userIdentity.userName!=requestParameters.userName | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter` [ESCU - Abnormally High AWS Instances Launched by User - Rule] action.escu = 0 @@ -1374,7 +1374,7 @@ search = `sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR action.escu = 0 action.escu.enabled = 1 description = this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. @@ -1387,12 +1387,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 5 +action.risk.param._risk_message = Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 5}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 5}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Account Discovery With Net App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002"]} +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 10, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_name", "role": ["Process"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -1455,10 +1462,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule] action.escu = 0 action.escu.enabled = 1 -description = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +description = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +action.escu.eli5 = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. action.escu.known_false_positives = network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered. action.escu.creation_date = 2021-05-26 @@ -1469,16 +1476,23 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 3 +action.risk.param._risk_message = Suspicious firewall modifications were detected via the registry on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 3}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 3}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +action.notable.param.rule_description = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule. action.notable.param.rule_title = Allow Inbound Traffic By Firewall Rule Registry action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -1496,10 +1510,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Allow Inbound Traffic In Firewall Rule - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is to detect suspicious powershell command to allow inbound traffic in specific local port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +description = The following analytic identifies suspicious PowerShell command to allow inbound traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} action.escu.data_models = [] -action.escu.eli5 = This search is to detect suspicious powershell command to allow inbound traffic in specific local port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +action.escu.eli5 = The following analytic identifies suspicious PowerShell command to allow inbound traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. action.escu.known_false_positives = administrator may allow inbound traffic in certain network or machine. action.escu.creation_date = 2021-05-19 @@ -1510,15 +1524,22 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 3 +action.risk.param._risk_message = Suspicious firewall modification detected on endpoint $ComputerName$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 3}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 3}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Allow Inbound Traffic In Firewall Rule - Rule -action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = This search is to detect suspicious powershell command to allow inbound traffic in specific local port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +action.notable.param.rule_description = The following analytic identifies suspicious PowerShell command to allow inbound traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. action.notable.param.rule_title = Allow Inbound Traffic In Firewall Rule action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -1577,10 +1598,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Allow Operation with Consent Admin - Rule] action.escu = 0 action.escu.enabled = 1 -description = this search is to detect a potential privilege escalation attempt to do malicious task. This registry modification is designed to allows the Consent Admin to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. +description = This analytic identifies a potential privilege escalation attempt to perform malicious task. This registry modification is designed to allow the `Consent Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"]} action.escu.data_models = [] -action.escu.eli5 = this search is to detect a potential privilege escalation attempt to do malicious task. This registry modification is designed to allows the Consent Admin to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. +action.escu.eli5 = This analytic identifies a potential privilege escalation attempt to perform malicious task. This registry modification is designed to allow the `Consent Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. action.escu.known_false_positives = unknown action.escu.creation_date = 2021-06-10 @@ -1591,16 +1612,23 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 25 +action.risk.param._risk_message = Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Allow Operation with Consent Admin - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = this search is to detect a potential privilege escalation attempt to do malicious task. This registry modification is designed to allows the Consent Admin to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. +action.notable.param.rule_description = This analytic identifies a potential privilege escalation attempt to perform malicious task. This registry modification is designed to allow the `Consent Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. action.notable.param.rule_title = Allow Operation with Consent Admin action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -1712,12 +1740,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike", "NOBELIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 64 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Anomalous usage of 7zip - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike", "NOBELIUM Group"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1560.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike", "NOBELIUM Group"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1560.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -1753,12 +1788,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell", "Ingress Tool Transfer"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Any Powershell DownloadFile - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Ingress Tool Transfer"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Ingress Tool Transfer"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Exploitation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -1794,12 +1836,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell", "HAFNIUM Group", "Ingress Tool Transfer"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString within PowerShell. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Any Powershell DownloadString - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "HAFNIUM Group", "Ingress Tool Transfer"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "HAFNIUM Group", "Ingress Tool Transfer"], "confidence": 70, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -1835,12 +1884,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Monitor for Unauthorized Software", "XMRig", "SamSam Ransomware", "Unusual Processes"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 64 +action.risk.param._risk_message = An attacker tool $process_name$,listed in attacker_tools.csv is executed on host $dest$ by User $user$. This process $process_name$ is known to do- $description$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attacker Tools On Endpoint - Rule -action.correlationsearch.annotations = {"analytic_story": ["Monitor for Unauthorized Software", "XMRig", "SamSam Ransomware", "Unusual Processes"], "cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1036.005", "T1595", "T1003"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Monitor for Unauthorized Software", "XMRig", "SamSam Ransomware", "Unusual Processes"], "cis20": ["CIS 2"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exploitation", "Stage:Recon", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1036.005", "T1595", "T1003"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process", "Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -1876,15 +1932,22 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Disabling Security Tools"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to add a certificate to the store on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 35}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attempt To Add Certificate To Untrusted Store - Rule -action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1553.004"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1553.004"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = ['user'] +action.notable.param.nes_fields = ['user', 'dest'] action.notable.param.rule_description = Attempt To Add Certificate To Untrusted Store action.notable.param.rule_title = Attempt To Add Certificate To Untrusted Store action.notable.param.security_domain = endpoint @@ -1898,7 +1961,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil* (Processes.process=*-addstore*) by Processes.parent_process Processes.process_name Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `attempt_to_add_certificate_to_untrusted_store_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil* (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `attempt_to_add_certificate_to_untrusted_store_filter` [ESCU - Attempt To Stop Security Service - Rule] action.escu = 0 @@ -1917,12 +1980,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Disabling Security Tools", "Trickbot"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 20 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 20}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 20}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attempt To Stop Security Service - Rule -action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools", "Trickbot"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools", "Trickbot"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -1939,7 +2009,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = net.exe OR Processes.process_name = sc.exe) Processes.process="* stop *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |lookup security_services_lookup service as process OUTPUTNEW category, description | search category=security | `attempt_to_stop_security_service_filter` +search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = net.exe OR Processes.process_name = sc.exe) Processes.process="* stop *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |lookup security_services_lookup service as process OUTPUTNEW category, description | search category=security | `attempt_to_stop_security_service_filter` [ESCU - Attempted Credential Dump From Registry via Reg exe - Rule] action.escu = 0 @@ -1958,12 +2028,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "DarkSide Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 90 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attempted Credential Dump From Registry via Reg exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -1980,7 +2057,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter` [ESCU - BCDEdit Failure Recovery Modification - Rule] action.escu = 0 @@ -1999,12 +2076,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ryuk Ransomware", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting disable the ability to recover the endpoint. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - BCDEdit Failure Recovery Modification - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Impact"], "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2040,12 +2124,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["BITS Jobs"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to persist using BITS. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - BITS Job Persistence - Rule -action.correlationsearch.annotations = {"analytic_story": ["BITS Jobs"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"]} +action.correlationsearch.annotations = {"analytic_story": ["BITS Jobs"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2081,12 +2172,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - BITSAdmin Download File - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197", "T1105"]} +action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197", "T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2122,12 +2220,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["SamSam Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Batch File Write to System32 - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1204.002"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1204.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2163,12 +2268,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 64 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - CMD Echo Pipe - Escalation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059.003", "T1543.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059.003", "T1543.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2204,12 +2316,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "ImageLoaded", "threat_object_type": "other"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"]} +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. @@ -2244,12 +2363,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 90 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - CertUtil Download With URLCache and Split Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]} +action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Command and Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2285,12 +2411,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 90 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]} +action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Command and Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2326,12 +2459,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Deobfuscate-Decode Files or Information"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 40 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 40}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - CertUtil With Decode Argument - Rule -action.correlationsearch.annotations = {"analytic_story": ["Deobfuscate-Decode Files or Information"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"]} +action.correlationsearch.annotations = {"analytic_story": ["Deobfuscate-Decode Files or Information"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2357,7 +2497,7 @@ description = This search looks for arguments to certutil.exe indicating the man action.escu.mappings = {"kill_chain_phases": ["Installation"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. -action.escu.how_to_implement = +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. action.escu.known_false_positives = Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services. action.escu.creation_date = 2021-01-26 action.escu.modification_date = 2021-01-26 @@ -2367,15 +2507,22 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Persistence Techniques", "Cloud Federated Credential Abuse"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Certutil exe certificate extraction - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Cloud Federated Credential Abuse"], "kill_chain_phases": ["Installation"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Cloud Federated Credential Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Installation"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = ['user'] +action.notable.param.nes_fields = ['user', 'dest'] action.notable.param.rule_description = This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. action.notable.param.rule_title = Certutil exe certificate extraction action.notable.param.security_domain = endpoint @@ -2389,7 +2536,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name Processes.process Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter` [ESCU - Child Processes of Spoolsv exe - Rule] action.escu = 0 @@ -2435,11 +2582,11 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces [ESCU - Clear Unallocated Sector Using Cipher App - Rule] action.escu = 0 action.escu.enabled = 1 -description = this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files. +description = this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files. -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.eli5 = this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. action.escu.known_false_positives = administrator may execute this app to manage disk action.escu.creation_date = 2021-06-10 action.escu.modification_date = 2021-06-10 @@ -2449,16 +2596,23 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 90 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Clear Unallocated Sector Using Cipher App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Impact"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files. +action.notable.param.rule_description = this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. action.notable.param.rule_title = Clear Unallocated Sector Using Cipher App action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -2523,7 +2677,7 @@ description = The following analytics are designed to identifies some CLOP ranso action.escu.mappings = {"kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1204"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytics are designed to identifies some CLOP ransomware variant that using arguments to execute its main code or feature of its code. In this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files in network shares and if it is "temp.dat", it will try to read from some stream pipe or file start encrypting files within the infected local machines. This technique can be also identified as an anti-sandbox technique to make its code non-responsive since it is waiting for some parameter to execute properly. -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. action.escu.known_false_positives = Operators can execute third party tools using these parameters. action.escu.creation_date = 2021-03-17 action.escu.modification_date = 2021-03-17 @@ -2533,12 +2687,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Clop Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 100 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting using arguments to execute its main code or feature of its code related to Clop ransomware. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 100}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 100}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Clop Common Exec Parameter - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1204"]} +action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 100, "kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1204"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2555,7 +2716,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name != "*temp.dat*" Processes.process = "*runrun*" OR Processes.process = "*temp.dat*" by Processes.parent_process_name Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter` +search = | tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name != "*temp.dat*" Processes.process = "*runrun*" OR Processes.process = "*temp.dat*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter` [ESCU - Clop Ransomware Known Service Name - Rule] action.escu = 0 @@ -2574,12 +2735,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Clop Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 100 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ executing known Clop Ransomware service names. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 100}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 100}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Clop Ransomware Known Service Name - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1543"]} +action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 100, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1543"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This detection is to identify the common service name created by the CLOP ransomware as part of its persistence and high privilege code execution in the infected machine. Ussually CLOP ransomware use StartServiceCtrlDispatcherW API in creating this service entry. @@ -3081,12 +3249,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike", "Trickbot", "DarkSide Ransomware"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $Computer$ by user $user$ accessing known suspicious named pipes related to Cobalt Strike. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cobalt Strike Named Pipes - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike", "Trickbot", "DarkSide Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1055"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike", "Trickbot", "DarkSide Ransomware"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1055"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Parent Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -3127,12 +3302,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware", "Clop Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 90 +action.risk.param._risk_message = A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware file extension and should be reviewed immediately. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Common Ransomware Extensions - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3168,12 +3350,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["SamSam Ransomware", "Ransomware", "Ryuk Ransomware", "Clop Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 90 +action.risk.param._risk_message = A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware note file and should be reviewed immediately. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Common Ransomware Notes - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ransomware", "Ryuk Ransomware", "Clop Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ransomware", "Ryuk Ransomware", "Clop Ransomware"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3209,12 +3398,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 64 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Conti Common Exec parameter - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3250,12 +3446,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated. +action.risk.param._risk = [{"threat_object_field": "TargetImage", "threat_object_type": "other"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Create Remote Thread into LSASS - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "TargetImage", "role": ["Other"], "type": "Other"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -3278,7 +3481,7 @@ search = `sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as f action.escu = 0 action.escu.enabled = 1 description = This detection is to identify a creation of "user mode service" where the service file path is located in non-common service folder in windows. -action.escu.mappings = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.001", "T1569.002"]} +action.escu.mappings = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"]} action.escu.data_models = [] action.escu.eli5 = This detection is to identify a creation of "user mode service" where the service file path is located in non-common service folder in windows. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. @@ -3291,12 +3494,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Clop Ransomware"] +action.risk = 1 +action.risk.param._risk_object = +action.risk.param._risk_object_type = +action.risk.param._risk_score = 56 +action.risk.param._risk_message = A service $Service_File_Name$ was created from a non-standard path using $Service_Name$, potentially leading to a privilege escalation. +action.risk.param._risk = [{"threat_object_field": "Service_File_Name", "threat_object_type": "other"}, {"threat_object_field": "Service_Name", "threat_object_type": "other"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Create Service In Suspicious File Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.001", "T1569.002"]} +action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"], "observable": [{"name": "Service_File_Name", "role": ["Other"], "type": "Other"}, {"name": "Service_Name", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -3332,12 +3542,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["DHS Report TA18-074A"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 30 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Create local admin accounts using net exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3373,12 +3590,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Hidden Cobra Malware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 25 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Create or delete windows shares using net exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3414,12 +3638,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Creation of Shadow Copy - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3455,12 +3686,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Creation of Shadow Copy with wmic and powershell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3482,10 +3720,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Creation of lsass Dump with Taskmgr - Rule] action.escu = 0 action.escu.enabled = 1 -description = Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. +description = Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. action.escu.mappings = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. +action.escu.eli5 = Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. action.escu.how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. action.escu.known_false_positives = Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. action.escu.creation_date = 2020-02-03 @@ -3496,16 +3734,23 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "TargetFilename", "threat_object_type": "file name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Creation of lsass Dump with Taskmgr - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "TargetFilename", "role": ["Victim"], "type": "File Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. +action.notable.param.rule_description = Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. action.notable.param.rule_title = Creation of lsass Dump with Taskmgr action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -3537,12 +3782,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3578,12 +3830,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Credential Dumping via Symlink to Shadow Copy - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3619,12 +3878,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - DLLHost with no Command Line Arguments with Network - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_image", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -3660,12 +3926,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - DNS Exfiltration Using Nslookup App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3891,12 +4164,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Domain Trust Discovery"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - DSQuery Domain Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Domain Trust Discovery"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"]} +action.correlationsearch.annotations = {"analytic_story": ["Domain Trust Discovery"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3937,12 +4217,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$ by $User$. +action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 81}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Delete ShadowCopy With PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. @@ -3977,12 +4264,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 25 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete accounts. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Deleting Of Net Users - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4018,12 +4312,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Log Manipulation", "SamSam Ransomware", "Ransomware", "Clop Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Deleting Shadow Copies - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "SamSam Ransomware", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 8", "CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "SamSam Ransomware", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 8", "CIS 10"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4376,12 +4677,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Lateral Movement"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the pass the hash technique. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "EventCode", "threat_object_type": "other"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Activity Related to Pass the Hash Attacks - Rule -action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550.002"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550.002"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "EventCode", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -4417,12 +4725,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect AzureHound Command-Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 80, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4458,12 +4773,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect AzureHound File Modifications - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 70, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -4619,12 +4941,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Detect Zerologon Attack"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous account. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "EventCode", "threat_object_type": "other"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Computer Changed with Anonymous Account - Rule -action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1210"], "nist": ["DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 6", "CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1210"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "EventCode", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -4660,12 +4989,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be investigated. +action.risk.param._risk = [{"threat_object_field": "source_image", "threat_object_type": "other"}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "TargetImage", "threat_object_type": "other"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Credential Dumping through LSASS access - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"], "observable": [{"name": "source_image", "role": ["Victim"], "type": "Other"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "TargetImage", "role": ["Victim"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -4732,12 +5068,12 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Detect Empire with PowerShell Script Block Logging - Rule] action.escu = 0 action.escu.enabled = 1 -description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} action.escu.data_models = [] -action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -4750,15 +5086,22 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = The following behavior was identified and typically related to PowerShell-Empire on $ComputerName$ by $User$. +action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 81}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Empire with PowerShell Script Block Logging - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.notable.param.rule_title = Detect Empire with PowerShell Script Block Logging @@ -4796,12 +5139,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Account Monitoring and Controls"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 36 +action.risk.param._risk_message = Multiple accounts have been locked out. Review $dest$ and results related to $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Excessive Account Lockouts From Endpoint - Rule -action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.002"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 60, "mitre_attack": ["T1078.002"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4837,12 +5187,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Account Monitoring and Controls"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 36 +action.risk.param._risk_message = Multiple accounts have been locked out. Review $nodename$ and $result$ related to $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}, {"threat_object_field": "result", "threat_object_type": "other"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Excessive User Account Lockouts - Rule -action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.003"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 60, "mitre_attack": ["T1078.003"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "result", "role": ["Victim"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -4878,12 +5235,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Exchange Web Shell - Rule -action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"]} +action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Exploitation"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -4999,12 +5363,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect HTML Help Renamed - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -5040,12 +5411,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect HTML Help Spawn Child Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -5081,12 +5459,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 90 +action.risk.param._risk_message = An instance of $parent_proces_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect HTML Help URL in Command Line - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -5122,12 +5507,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -5284,12 +5676,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious MSHTA Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $est$ by user $user$ attempting to access a remote destination to download an additional payload. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect MSHTA Url in Command Line - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -5325,12 +5724,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 64 +action.risk.param._risk_message = A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "ImageLoaded", "threat_object_type": "parent process"}, {"threat_object_field": "Image", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Mimikatz Using Loaded Images - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"], "cis20": ["CIS 6", "CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Parent Process"}, {"name": "Image", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -5410,12 +5816,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 90 +action.risk.param._risk_message = The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $ComputerName$ by $User$. +action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 90}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ @@ -5452,12 +5865,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["DHS Report TA18-074A", "HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect New Local Admin account - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1136.001"], "nist": ["PR.AC", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1136.001"], "nist": ["PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -5567,8 +5987,8 @@ action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. action.escu.how_to_implement = action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. -action.escu.creation_date = 2021-01-12 -action.escu.modification_date = 2021-01-12 +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 action.escu.confidence = high action.escu.full_search_name = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule action.escu.search_type = detection @@ -5598,7 +6018,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` +search = `cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` [ESCU - Detect New Open S3 buckets - Rule] action.escu = 0 @@ -5609,8 +6029,8 @@ action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. action.escu.how_to_implement = You must install the AWS App for Splunk. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. -action.escu.creation_date = 2021-01-12 -action.escu.modification_date = 2021-01-12 +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 action.escu.confidence = high action.escu.full_search_name = ESCU - Detect New Open S3 buckets - Rule action.escu.search_type = detection @@ -5640,7 +6060,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` +search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` [ESCU - Detect Outbound SMB Traffic - Rule] action.escu = 0 @@ -5740,12 +6160,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Persistence Techniques"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Path Interception By Creation Of program exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -5821,12 +6248,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Prohibited Applications Spawning cmd exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -5862,15 +6296,22 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 35}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect PsExec With accepteula Flag - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = ['dest'] +action.notable.param.nes_fields = ['user', 'dest'] action.notable.param.rule_description = This search looks for events where `PsExec.exe` is run with the `accepteula` flag in the command line. PsExec is a built-in Windows utility that enables you to execute processes on other systems. It is fully interactive for console applications. This tool is widely used for launching interactive command prompts on remote systems. Threat actors leverage this extensively for executing code on compromised systems. If an attacker is running PsExec for the first time, they will be prompted to accept the end-user license agreement (EULA), which can be passed as the argument `accepteula` within the command line. action.notable.param.rule_title = Detect PsExec With accepteula Flag action.notable.param.security_domain = endpoint @@ -5884,7 +6325,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*psexec* Processes.process=*accepteula* by Processes.process_name Processes.dest Processes.parent_process_name | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter` +search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*psexec* Processes.process=*accepteula* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter` [ESCU - Detect RClone Command-Line Usage - Rule] action.escu = 0 @@ -5903,12 +6344,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 35}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect RClone Command-Line Usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"]} +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 50, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -5985,12 +6433,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 64 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior for $parent_process_name$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regasm Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6026,12 +6481,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regasm with Network Connection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -6067,12 +6529,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regasm with no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_image", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -6108,12 +6577,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 64 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ typically not normal for this process. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regsvcs Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6149,12 +6625,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regsvcs with Network Connection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -6190,12 +6673,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regsvcs with No Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_image", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -6233,12 +6723,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Cobalt Strike"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regsvr32 Application Control Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Cobalt Strike"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Cobalt Strike"], "cis20": ["CIS 8", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6275,12 +6772,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Collection and Staging"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 27 +action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Renamed 7-Zip - Rule -action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1560.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1560.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -6316,12 +6820,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 27 +action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Renamed PSExec - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "kill_chain_phases": ["Exploitation", "Lateral Movement", "Execution"], "mitre_attack": ["T1569.002"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exploitation", "Lateral Movement", "Execution"], "mitre_attack": ["T1569.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -6357,12 +6868,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 27 +action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Renamed RClone - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"]} +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -6398,12 +6916,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Collection and Staging"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 27 +action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Renamed WinRAR - Rule -action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "kill_chain_phases": ["Exploitation", "Exfiltration"], "mitre_attack": ["T1560.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exploitation", "Exfiltration"], "mitre_attack": ["T1560.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -6480,12 +7005,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6502,7 +7034,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*advpack* by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___advpack_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*advpack* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___advpack_filter` [ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule] action.escu = 0 @@ -6521,12 +7053,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6543,7 +7082,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*setupapi* by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___setupapi_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*setupapi* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___setupapi_filter` [ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule] action.escu = 0 @@ -6562,12 +7101,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6584,7 +7130,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*syssetup* by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___syssetup_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*syssetup* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___syssetup_filter` [ESCU - Detect Rundll32 Inline HTA Execution - Rule] action.escu = 0 @@ -6603,12 +7149,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious MSHTA Activity", "NOBELIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = Suspicious rundll32.exe inline HTA execution on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rundll32 Inline HTA Execution - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "NOBELIUM Group"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "NOBELIUM Group"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6731,12 +7284,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 24 +action.risk.param._risk_message = Possible SharpHound command-Line arguments identified on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect SharpHound Command-Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6772,12 +7332,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 24 +action.risk.param._risk_message = Potential SharpHound file modifications identified on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 24}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect SharpHound File Modifications - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -6813,12 +7380,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 24 +action.risk.param._risk_message = Potential SharpHound binary identified on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect SharpHound Usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -7344,12 +7918,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A ", "Suspicious Command-Line Executions"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = cmd.exe launching script interpreters on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule -action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Command-Line Executions"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Command-Line Executions"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7395,12 +7976,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious WMI Use"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Possible malicious WMI Subscription created on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect WMI Event Subscription Persistence - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ @@ -7695,12 +8283,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious MSHTA Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 90 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect mshta inline hta execution - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7736,12 +8331,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious MSHTA Activity"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect mshta renamed - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -7866,12 +8468,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Unusual Processes"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 32 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 32}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 32}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect processes used for System Network Configuration Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1016"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 2"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 40, "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1016"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8114,12 +8723,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 24 +action.risk.param._risk_message = WevtUtil.exe used to disable Event Logging on $dest +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Logs Using WevtUtil - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8141,10 +8757,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Disable Registry Tool - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is to identifies modification of registry to disable the regedit or registry tools of windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. +description = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search is to identifies modification of registry to disable the regedit or registry tools of windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. +action.escu.eli5 = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. action.escu.known_false_positives = admin may disable this application for non technical user. action.escu.creation_date = 2021-03-31 @@ -8155,16 +8771,23 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = +action.risk.param._risk_object_type = +action.risk.param._risk_score = 40 +action.risk.param._risk_message = Disabled Registry Tools +action.risk.param._risk = [] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Registry Tool - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search is to identifies modification of registry to disable the regedit or registry tools of windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. +action.notable.param.rule_description = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. action.notable.param.rule_title = Disable Registry Tool action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -8182,10 +8805,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Disable Show Hidden Files - Rule] action.escu = 0 action.escu.enabled = 1 -description = The following search is to idetifies a modification in registry to prevent the user seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. +description = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = The following search is to idetifies a modification in registry to prevent the user seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. +action.escu.eli5 = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. action.escu.known_false_positives = unknown action.escu.creation_date = 2021-03-31 @@ -8196,16 +8819,23 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = +action.risk.param._risk_object_type = +action.risk.param._risk_score = 40 +action.risk.param._risk_message = Disabled 'Show Hidden Files' +action.risk.param._risk = [] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Show Hidden Files - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The following search is to idetifies a modification in registry to prevent the user seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. +action.notable.param.rule_description = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. action.notable.param.rule_title = Disable Show Hidden Files action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -8237,12 +8867,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = +action.risk.param._risk_object_type = +action.risk.param._risk_score = 40 +action.risk.param._risk_message = Disabled 'Windows App Hotkeys' +action.risk.param._risk = [] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Windows App Hotkeys - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8278,12 +8915,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 40 +action.risk.param._risk_message = Windows Defender real time behavior monitoring disabled on $dest +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Windows Behavior Monitoring - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware"], "confidence": 100, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8320,18 +8964,18 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = Registry.use -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 40 -action.risk.param._risk_message = $Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$ to disable the smartscreen protection of windows machine -action.risk.param._risk = [{"risk_object_field": "Registry.dest", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "Registry.use", "risk_object_type": "user", "risk_score": 40}, {"threat_object_field": "Registry.registry_key_name", "threat_object_type": "other"}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 25 +action.risk.param._risk_message = The Windows Smartscreen was disabled on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Windows SmartScreen Protection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "Registry.dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Registry.use", "role": ["Victim"], "type": "User"}, {"name": "Registry.registry_key_name", "role": ["Target"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8368,18 +9012,18 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = Registry.user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 40 -action.risk.param._risk_message = $Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$ to disable to disable the cmd prompt application of a windows machine -action.risk.param._risk = [{"risk_object_field": "Registry.dest", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "Registry.user", "risk_object_type": "user", "risk_score": 40}, {"threat_object_field": "Registry.registry_key_name", "threat_object_type": "other"}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 25 +action.risk.param._risk_message = The Windows command prompt was disabled on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling CMD Application - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "Registry.dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Registry.user", "role": ["Victim"], "type": "User"}, {"name": "Registry.registry_key_name", "role": ["Target"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8416,18 +9060,18 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = Registry.user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 40 -action.risk.param._risk_message = $Registry.user$ on $Registry.dest$ modified registry keyname=$Registry.registry_key_name$ to disable to disable the control panel window on a windows machine -action.risk.param._risk = [{"risk_object_field": "Registry.dest", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "Registry.user", "risk_object_type": "user", "risk_score": 40}, {"threat_object_field": "Registry.registry_key_name", "threat_object_type": "other"}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 25 +action.risk.param._risk_message = The Windows Control Panel was disabled on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling ControlPanel - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "Registry.dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Registry.user", "role": ["Victim"], "type": "User"}, {"name": "Registry.registry_key_name", "role": ["Target"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8464,18 +9108,18 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = Processes.user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 40 -action.risk.param._risk_message = $Processes.user$ on $Processes.dest$ used the netsh application in a suspicious manner to disable the firewall -action.risk.param._risk = [{"risk_object_field": "Processes.dest", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "Processes.user", "risk_object_type": "user", "risk_score": 40}, {"threat_object_field": "Processes.process", "threat_object_type": "process"}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 25 +action.risk.param._risk_message = The Windows Firewall was disabled on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling Firewall with Netsh - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "Processes.dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.user", "role": ["Victim"], "type": "User"}, {"name": "Processes.process", "role": ["Target"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8512,18 +9156,18 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = Registry.user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 40 -action.risk.param._risk_message = $Registry.user$ on $Registry.dest modified registry key name=$Registry.registry_key_name$ to disable the folder options feature of windows to show hidden files, file extensions, etc -action.risk.param._risk = [{"risk_object_field": "Registry.dest", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "Registry.user", "risk_object_type": "user", "risk_score": 40}, {"threat_object_field": "Registry.registry_key_name", "threat_object_type": "other"}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 25 +action.risk.param._risk_message = The Windows Folder Options, to hide files, was disabled on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling FolderOptions Windows Feature - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "Registry.dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Registry.user", "role": ["Victim"], "type": "User"}, {"name": "Registry.registry_key_name", "role": ["Target"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8560,18 +9204,18 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = Processes.user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 40 -action.risk.param._risk_message = $Processes.user$ on $Processes.dest$ used a suspicious command ($Processes.process_name$) that disabled a user account using the net.exe utility native to Windows -action.risk.param._risk = [{"risk_object_field": "Processes.dest", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "Processes.user", "risk_object_type": "user", "risk_score": 40}, {"threat_object_field": "Processes.process_name", "threat_object_type": "process"}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling Net User Account - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"], "observable": [{"name": "Processes.dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.user", "role": ["Victim"], "type": "User"}, {"name": "Processes.process_name", "role": ["Target"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8608,18 +9252,18 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = Registry.use -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 40 -action.risk.param._risk_message = $Registry.user$ on $Registry.dest$ modified registry key $Registry.registry_key_name$ to disable run application in window start menu -action.risk.param._risk = [{"risk_object_field": "Registry.dest", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "Registry.use", "risk_object_type": "user", "risk_score": 40}, {"threat_object_field": "Registry.registry_key_name", "threat_object_type": "other"}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 25 +action.risk.param._risk_message = The Windows registry was modified to disable run application in window start menu on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling NoRun Windows App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "Registry.dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Registry.use", "role": ["Victim"], "type": "User"}, {"name": "Registry.registry_key_name", "role": ["Target"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8656,18 +9300,18 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities"] action.risk = 1 -action.risk.param._risk_object = Registry.user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 40 -action.risk.param._risk_message = $Registry.user$ on $Registry.dest$ modified registry key=$Registry.registry_key_name$ that controls the enforcement of Windows User Account Control (UAC) -action.risk.param._risk = [{"risk_object_field": "Registry.dest", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "Registry.user", "risk_object_type": "user", "risk_score": 40}, {"threat_object_field": "Registry.registry_key_name", "threat_object_type": "other"}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling Remote User Account Control - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "Registry.dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Registry.user", "role": ["Victim"], "type": "User"}, {"name": "Registry.registry_key_name", "role": ["Target"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -8704,18 +9348,18 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = Registry.user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 70 -action.risk.param._risk_message = $Registry.user$ on $Registry.dest$ modified registry key=$Registry.registry_key_name$ which disables the system restore of a machine -action.risk.param._risk = [{"risk_object_field": "Registry.dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "Registry.user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "Registry.registry_key_name", "threat_object_type": "other"}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = The Windows registry was modified to disable system restore on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling SystemRestore In Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "Registry.dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Registry.user", "role": ["Victim"], "type": "User"}, {"name": "Registry.registry_key_name", "role": ["Target"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8752,18 +9396,18 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = Registry.user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 40 -action.risk.param._risk_message = $Registry.user$ on $Registry.dest$ modified registry key=$Registry.registry_key_name$ which disables the task manager of windows operating system -action.risk.param._risk = [{"risk_object_field": "Registry.dest", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "Registry.user", "risk_object_type": "user", "risk_score": 40}, {"threat_object_field": "Registry.registry_key_name", "threat_object_type": "other"}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = The Windows Task Manager was disabled on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling Task Manager - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "Registry.dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Registry.user", "role": ["Victim"], "type": "User"}, {"name": "Registry.registry_key_name", "role": ["Target"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8799,12 +9443,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Suspicious files were downloaded with the Telegram application on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Download Files Using Telegram - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic will identify a suspicious download by the Telegram application on a Windows system. This behavior was identified on a honeypot where the adversary gained access, installed Telegram and followed through with downloading different network scanners (port, bruteforcer, masscan) to the system and later used to mapped the whole network and further move laterally. @@ -8839,12 +9490,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Dump LSASS via comsvcs DLL - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8882,12 +9540,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Dump LSASS via procdump - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8926,12 +9591,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$, attempting to dump lsass.exe. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Dump LSASS via procdump Rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -9308,12 +9980,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = RDP was moved to a non-standard port on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Enable RDP In Other Port Number - Rule -action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021"]} +action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -9349,12 +10028,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = The Telegram application has been identified enumerating local groups on $ComputerName$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 80}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Enumerate Users Local Group Using Telegram - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This analytic will detect a suspicious Telegram process enumerating all network users in a local group. This technique was seen in a Monero infected honeypot to mapped all the users on the compromised system. EventCode 4798 is generated when a process enumerates a user's security-enabled local groups on a computer or device. @@ -9389,12 +10075,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Eventvwr UAC Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548.002"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -9430,12 +10123,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excel Spawning PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -9471,12 +10171,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excel Spawning Windows Script Host - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -9512,12 +10219,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive Attempt To Disable Services - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -9593,12 +10307,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive Service Stop Attempt - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -9634,12 +10355,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to modify permissions. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive Usage Of Cacls App - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -9858,12 +10586,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["meterpreter"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = Multiple processes were executed out of windows\temp within a short amount of time on $dest$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive number of distinct processes created in Windows Temp folder - Rule -action.correlationsearch.annotations = {"analytic_story": ["meterpreter"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} +action.correlationsearch.annotations = {"analytic_story": ["meterpreter"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -9899,12 +10634,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive number of service control start as disabled - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -9940,12 +10682,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Meterpreter"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ indicative of suspicious behavior. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive number of taskhost processes - Rule -action.correlationsearch.annotations = {"analytic_story": ["Meterpreter"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1033"]} +action.correlationsearch.annotations = {"analytic_story": ["Meterpreter"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -12228,12 +12977,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell", "NOBELIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Powershell.exe running potentially malicious encodede commands on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Malicious PowerShell Process - Encoded Command - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "NOBELIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "NOBELIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12269,12 +13025,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["DHS Report TA18-074A", "HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = PowerShell local execution policy bypass attempt on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -12351,12 +13114,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = Powershell.exe running with potential obfuscated arguments on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12440,12 +13210,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 54 +action.risk.param._risk_message = Wallpaper modification on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Modification Of Wallpaper - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This analytic identifies suspicious modification of registry to deface or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain a note that the machine was compromised and make it as a wallpaper. @@ -12480,12 +13257,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 32 +action.risk.param._risk_message = Suspicious ACL permission modification on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 32}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Modify ACL permission To Files Or Folder - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12601,12 +13385,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 64 +action.risk.param._risk_message = New print monitor added on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Monitor Registry Keys for Print Monitors - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010"], "nist": ["PR.PT", "DE.CM", "PR.AC"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8", "CIS 5"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010"], "nist": ["PR.PT", "DE.CM", "PR.AC"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -12777,12 +13568,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Active Directory Password Spraying"] +action.risk = 1 +action.risk.param._risk_object = Client_Address +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$ +action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ @@ -12826,12 +13624,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Active Directory Password Spraying"] +action.risk = 1 +action.risk.param._risk_object = Client_Address +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$ +action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ @@ -12875,12 +13680,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Active Directory Password Spraying"] +action.risk = 1 +action.risk.param._risk_object = Source_Workstation +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Potential NTLM based password spraying attack from $Source_Workstation$ +action.risk.param._risk = [{"risk_object_field": "Source_Workstation", "risk_object_type": "system", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Source_Workstation", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC0000064 stands for `The username you typed does not exist` (the attempted user is a legitimate domain user).\ @@ -12964,12 +13776,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Active Directory Password Spraying"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Potential password spraying attack from $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ @@ -13013,12 +13832,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Active Directory Password Spraying"] +action.risk = 1 +action.risk.param._risk_object = Client_Address +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$ +action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user is a legitimate domain user).\ @@ -13062,12 +13888,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Active Directory Password Spraying"] +action.risk = 1 +action.risk.param._risk_object = Source_Workstation +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Potential NTLM based password spraying attack from $Source_Workstation$ +action.risk.param._risk = [{"risk_object_field": "Source_Workstation", "risk_object_type": "system", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Source_Workstation", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted user is a legitimate domain user).\ @@ -13111,12 +13944,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Active Directory Password Spraying"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Potential password spraying attack from $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Users Failing To Authenticate From Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies a source process name failing to authenticate with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 generates on domain controllers, member servers, and workstations when an account fails to logon. Logon Type 2 describes an iteractive logon attempt.\ @@ -13160,12 +14000,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Active Directory Password Spraying"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Potential password spraying attack on $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies a source host failing to authenticate against a remote host with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers, and workstations. Logon Type 3 describes an remote authentication attempt.\ @@ -13203,12 +14050,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ryuk Ransomware", "Domain Trust Discovery"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 15 +action.risk.param._risk_message = Domain trust discovery execution on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - NLTest Domain Trust Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Domain Trust Discovery"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Domain Trust Discovery"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -13285,12 +14139,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Nishang PowershellTCPOneLine - Rule -action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} +action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Command and Control"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -13371,12 +14232,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 50 +action.risk.param._risk_message = Active Directory NTDS export on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 50}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Ntdsutil Export NTDS - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -13490,8 +14358,8 @@ action.escu.data_models = [] action.escu.eli5 = This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system. action.escu.how_to_implement = You must install Splunk Microsoft Office 365 add-on. This search works with o365:management:activity action.escu.known_false_positives = Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration. -action.escu.creation_date = 2021-01-12 -action.escu.modification_date = 2021-01-12 +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 action.escu.confidence = high action.escu.full_search_name = ESCU - O365 Bypass MFA via Trusted IP - Rule action.escu.search_type = detection @@ -13521,7 +14389,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy | rex max_match=100 field=ModifiedProperties{}.NewValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | rex max_match=100 field=ModifiedProperties{}.OldValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) |stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature vendor_product vendor_account status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `o365_bypass_mfa_via_trusted_ip_filter` +search = `o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy | rex max_match=100 field=ModifiedProperties{}.NewValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | rex max_match=100 field=ModifiedProperties{}.OldValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) |stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature Workload vendor_account status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `o365_bypass_mfa_via_trusted_ip_filter` [ESCU - O365 Disable MFA - Rule] action.escu = 0 @@ -13876,12 +14744,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments", "Trickbot"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Office application spawning rundll32.exe on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Application Spawn rundll32 process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -13917,12 +14792,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Office document creating a schedule task on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Document Creating Schedule Task - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this search detects a potential malicious office document that create schedule task entry through macro VBA api or through loading taskschd.dll. This technique was seen in so many malicious macro malware that create persistence , beaconing using task schedule malware entry The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it's possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' @@ -13957,12 +14839,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments", "Trickbot"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Office document executing a macro on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Document Executing Macro Code - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this detection was designed to identifies suspicious office documents that using macro code. Macro code is known to be one of the prevalent weaponization or attack vector of threat actor. This malicious macro code is embed to a office document as an attachment that may execute malicious payload, download malware payload or other malware component. It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. @@ -13997,12 +14886,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Office document spawning suspicious child process on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Document Spawned Child Process To Download - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this search is to detect potential malicious office document executing lolbin child process to download payload or other malware. Since most of the attacker abused the capability of office document to execute living on land application to blend it to the normal noise in the infected machine to cover its track. @@ -14669,7 +15565,7 @@ action.escu.eli5 = The following analytic utilizes PowerShell Script Block Loggi This analytic identifies the use of PowerShell loading .net assembly via reflection. This is commonly found in malicious PowerShell usage, including Empire and Cobalt Strike. In addition, the `load(` value may be modifed by removing `(` and it will identify more events to review. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -action.escu.known_false_positives = False positives will be limited to +action.escu.known_false_positives = False positives should be limited as day to day scripts do not use this method. action.escu.creation_date = 2021-06-10 action.escu.modification_date = 2021-06-10 action.escu.confidence = high @@ -14708,7 +15604,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `powershell` EventCode=4104 Message="*[system.reflection.assembly]::load(*" | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter` +search = `powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*") | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter` [ESCU - PowerShell Start-BitsTransfer - Rule] action.escu = 0 @@ -18242,12 +19138,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] +action.risk = 1 +action.risk.param._risk_object = +action.risk.param._risk_object_type = +action.risk.param._risk_score = 42 +action.risk.param._risk_message = Safeboot registry $Registry.registry_path$ was added or modified with a new value $Registry.registry_value_name$ +action.risk.param._risk = [] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Start Up During Safe Mode Boot - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -18447,12 +19350,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Suspicious dllhost.exe process with no command line arguments executed on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious DLLHost no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -18488,12 +19398,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Suspicious driver $ImageLoaded$ on $Computer$ +action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "ImageLoaded", "threat_object_type": "file name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Driver Loaded Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "ImageLoaded", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This analytic will detect suspicious driver loaded paths. This technique is commonly used by malicious software like coin miners (xmrig) to register its malicious driver from notable directories where executable or drivers do not commonly exist. During triage, validate this driver is for legitimate business use. Review the metadata and certificate information. Unsigned drivers from non-standard paths is not normal, but occurs. In addition, review driver loads into `ntoskrnl.exe` for possible other drivers of interest. Long tail analyze drivers by path (outside of default, and in default) for further review. @@ -18509,7 +19426,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) | stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_driver_loaded_path_filter` +search = `sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) | stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_driver_loaded_path_filter` [ESCU - Suspicious Email - UBA Anomaly - Rule] action.escu = 0 @@ -18611,12 +19528,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 9 +action.risk.param._risk_message = The Windows Event Log Service shutdown on $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 9}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Event Log Service Behavior - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -18693,12 +19617,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Suspicious gpupdate.exe process with no command line arguments executed on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious GPUpdate no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -18775,12 +19706,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Suspicious renamed msbuild.exe binary ran on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious MSBuild Rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -18816,12 +19754,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 42 +action.risk.param._risk_message = Suspicious msbuild.exe process executed on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 42}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious MSBuild Spawn - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -18980,12 +19925,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Suspicioues process $Processes.process_path.file_path$ running from suspicious location +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Process File Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19021,12 +19973,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Disabling Security Tools", "DHS Report TA18-074A"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process running with an uncommon parent process $Processes.parent_process_name$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Reg exe Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19062,12 +20021,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvr32 Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process potentially loading malicious code +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19103,12 +20069,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Masquerading - Rename System Utilities"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Suspicious renamed rundll32.exe binary ran on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Rundll32 Rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -19144,12 +20117,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 35 +action.risk.param._risk_message = rundll32.exe running with suspicious parameters on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Rundll32 StartW - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19185,12 +20165,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = $Processes.process_path.file_path$ process potentially loading malicious code +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Rundll32 dllregisterserver - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19226,12 +20213,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Rundll32 no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -19308,12 +20302,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Suspicious scheduled task registered on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Scheduled Task from Public Directory - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques"], "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1053.005"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19349,12 +20350,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -19390,12 +20398,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Suspicious renamed microsoft.workflow.compiler.exe binary ran on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious microsoft workflow compiler rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -19431,12 +20446,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious microsoft workflow compiler usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19472,12 +20494,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious msbuild path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19561,12 +20590,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious MSHTA Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = mshta.exe spawned by wmiprvse.exe on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious mshta spawn - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19602,12 +20638,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 28 +action.risk.param._risk_message = Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 28}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious wevtutil Usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -19683,12 +20726,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Collection and Staging"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 28 +action.risk.param._risk_message = Suspicious writes to windows Recycle Bin process $Processes.process_name$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"threat_object_field": "Processes.process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious writes to windows Recycle Bin - Rule -action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 8"], "mitre_attack": ["T1036"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "mitre_attack": ["T1036"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19724,12 +20774,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 15 +action.risk.param._risk_message = Potential system information discovery behavior on $dest$ by $User$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "User", "threat_object_type": "user"}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "User", "threat_object_type": "user"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - System Information Discovery Detection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "cis20": ["CIS 6", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Recon", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Attacker"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19769,12 +20826,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware", "Masquerading - Rename System Utilities"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = System process running from unexpected location on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "Processes.process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - System Processes Run From Unexpected Locations - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19852,12 +20916,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = Possible Trickbot namedpipe created on $Computer$ by $Image$ +action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "Image", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Trickbot Named Pipe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "Image", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this search is to detect potential trickbot infection through the create/connected named pipe to the system. This technique is used by trickbot to communicate to its c2 to post or get command during infection. @@ -19892,12 +20963,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 45 +action.risk.param._risk_message = Possible USN journal deletion on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - USN Journal Deletion - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware"], "cis20": ["CIS 6", "CIS 8", "CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070"], "nist": ["DE.CM", "PR.PT", "DE.AE", "DE.DP", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware"], "cis20": ["CIS 6", "CIS 8", "CIS 10"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070"], "nist": ["DE.CM", "PR.PT", "DE.AE", "DE.DP", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19974,12 +21052,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = Possible CVE-2021-26857 exploitation on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unified Messaging Service Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]} +action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -20015,12 +21100,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Disabling Security Tools"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 45 +action.risk.param._risk_message = Possible Sysmon filter driver unloading on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unload Sysmon Filter Driver - Rule -action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -20060,12 +21152,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Possible AMSI Unloading via Reflection using PowerShell on $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unloading AMSI via Reflection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ @@ -20183,12 +21282,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = Unusually long command line $Processes.process_name$ on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "Processes.process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unusually Long Command Line - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -20305,12 +21411,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = Possible Web Shell execution on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - W3WP Spawning Shell - Rule -action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"]} +action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -20346,12 +21459,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ryuk Ransomware", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 15 +action.risk.param._risk_message = System backups deletion on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WBAdmin Delete System Backups - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -20578,12 +21698,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Suspicious COM Object Execution on $Computer$ +action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 35}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Wbemprox COM Object Execution - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this search is designed to detect potential malicious process loading COM object to wbemprox.dll, @@ -20781,12 +21908,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = Wermgr.exe process connecting IP location web services on $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Wermgr Process Connecting To IP Check Web Services - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590.005"]} +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590.005"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. @@ -20821,12 +21955,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = Wermgr.exe writing executable files on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Wermgr Process Create Executable File - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027"]} +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -20862,12 +22003,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = Wermgr.exe spawning suspicious processes on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -21103,12 +22251,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ryuk Ransomware", "Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 24 +action.risk.param._risk_message = Windows DisableAntiSpyware registry key set to 'disabled' on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows DisableAntiSpyware Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Windows Defense Evasion Tactics"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Windows Defense Evasion Tactics"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index c870fbc67d..974200a69a 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T17:26:55 UTC +# On Date: 2021-07-20T20:51:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index 163867b19a..ad16c04056 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T17:26:56 UTC +# On Date: 2021-07-20T20:51:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -1551,7 +1551,7 @@ asset_type = confidence = medium explanation = this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002"]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} known_false_positives = admin or power user may used this series of command. providing_technologies = [] @@ -1569,7 +1569,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +explanation = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} known_false_positives = network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered. @@ -1579,7 +1579,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = This search is to detect suspicious powershell command to allow inbound traffic in specific local port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +explanation = The following analytic identifies suspicious PowerShell command to allow inbound traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} known_false_positives = administrator may allow inbound traffic in certain network or machine. @@ -1599,7 +1599,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = this search is to detect a potential privilege escalation attempt to do malicious task. This registry modification is designed to allows the Consent Admin to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. +explanation = This analytic identifies a potential privilege escalation attempt to perform malicious task. This registry modification is designed to allow the `Consent Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"]} known_false_positives = unknown @@ -1790,7 +1790,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. -how_to_implement = +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. annotations = {"kill_chain_phases": ["Installation"]} known_false_positives = Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services. providing_technologies = [] @@ -1809,8 +1809,8 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files. -how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +explanation = this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]} known_false_positives = administrator may execute this app to manage disk providing_technologies = [] @@ -1832,7 +1832,7 @@ type = detection asset_type = confidence = medium explanation = The following analytics are designed to identifies some CLOP ransomware variant that using arguments to execute its main code or feature of its code. In this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files in network shares and if it is "temp.dat", it will try to read from some stream pipe or file start encrypting files within the infected local machines. This technique can be also identified as an anti-sandbox technique to make its code non-responsive since it is waiting for some parameter to execute properly. -how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. annotations = {"kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1204"]} known_false_positives = Operators can execute third party tools using these parameters. providing_technologies = [] @@ -2022,7 +2022,7 @@ asset_type = confidence = medium explanation = This detection is to identify a creation of "user mode service" where the service file path is located in non-common service folder in windows. how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. -annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.001", "T1569.002"]} +annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"]} known_false_positives = unknown providing_technologies = [] @@ -2070,7 +2070,7 @@ providing_technologies = [] type = detection asset_type = Windows confidence = medium -explanation = Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. +explanation = Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} known_false_positives = Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. @@ -2391,7 +2391,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -3229,7 +3229,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = This search is to identifies modification of registry to disable the regedit or registry tools of windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. +explanation = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} known_false_positives = admin may disable this application for non technical user. @@ -3239,7 +3239,7 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = The following search is to idetifies a modification in registry to prevent the user seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. +explanation = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001"]} known_false_positives = unknown @@ -4770,7 +4770,7 @@ This analytic identifies the use of PowerShell loading .net assembly via reflect During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} -known_false_positives = False positives will be limited to +known_false_positives = False positives should be limited as day to day scripts do not use this method. providing_technologies = [] [savedsearch://ESCU - PowerShell Start-BitsTransfer - Rule] diff --git a/dist/saaws/default/analytic_stories.conf b/dist/saaws/default/analytic_stories.conf index 8b9e7c72ed..30b4189b12 100644 --- a/dist/saaws/default/analytic_stories.conf +++ b/dist/saaws/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T17:27:19 UTC +# On Date: 2021-07-20T20:51:41 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/analyticstories.conf b/dist/saaws/default/analyticstories.conf index e3798fefc1..2e23fdb9e2 100644 --- a/dist/saaws/default/analyticstories.conf +++ b/dist/saaws/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T17:27:19 UTC +# On Date: 2021-07-20T20:51:41 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/app.conf b/dist/saaws/default/app.conf index 0d94968c4a..369032885d 100644 --- a/dist/saaws/default/app.conf +++ b/dist/saaws/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 34688 +build = 34790 [triggers] reload.analytic_stories = simple diff --git a/dist/saaws/default/collections.conf b/dist/saaws/default/collections.conf index 9943ab182e..35e6437f0c 100644 --- a/dist/saaws/default/collections.conf +++ b/dist/saaws/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T17:27:19 UTC +# On Date: 2021-07-20T20:51:41 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/macros.conf b/dist/saaws/default/macros.conf index 526c385a4c..ec9a0f2606 100644 --- a/dist/saaws/default/macros.conf +++ b/dist/saaws/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T17:27:19 UTC +# On Date: 2021-07-20T20:51:41 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/savedsearches.conf b/dist/saaws/default/savedsearches.conf index 1981a03dce..d75afbde0b 100644 --- a/dist/saaws/default/savedsearches.conf +++ b/dist/saaws/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T17:27:19 UTC +# On Date: 2021-07-20T20:51:41 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -58,8 +58,8 @@ action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. -action.escu.creation_date = 2021-03-02 -action.escu.modification_date = 2021-03-02 +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 action.escu.confidence = high action.escu.full_search_name = ESCU - AWS CreateAccessKey - Rule action.escu.search_type = detection @@ -89,7 +89,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success| search userName!=requestParameters.userName | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_createaccesskey_filter` +search = `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success| search userIdentity.userName!=requestParameters.userName | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_createaccesskey_filter` [ESCU - AWS CreateLoginProfile - Rule] action.escu = 0 @@ -100,8 +100,8 @@ action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user. -action.escu.creation_date = 2021-03-02 -action.escu.modification_date = 2021-03-02 +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 action.escu.confidence = high action.escu.full_search_name = ESCU - AWS CreateLoginProfile - Rule action.escu.search_type = detection @@ -131,7 +131,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `cloudtrail` eventName = CreateLoginProfile | rename requestParameters.userName as new_login_profile | table src_ip eventName new_login_profile userName | join new_login_profile src_ip [| search `cloudtrail` eventName = ConsoleLogin | rename userName as new_login_profile | stats count values(eventName) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn new_login_profile src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`] | `aws_createloginprofile_filter` +search = `cloudtrail` eventName = CreateLoginProfile | rename requestParameters.userName as new_login_profile | table src_ip eventName new_login_profile userIdentity.userName | join new_login_profile src_ip [| search `cloudtrail` eventName = ConsoleLogin | rename userIdentity.userName as new_login_profile | stats count values(eventName) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn new_login_profile src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`] | `aws_createloginprofile_filter` [ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule] action.escu = 0 @@ -730,8 +730,8 @@ action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. -action.escu.creation_date = 2021-03-02 -action.escu.modification_date = 2021-03-02 +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 action.escu.confidence = high action.escu.full_search_name = ESCU - AWS UpdateLoginProfile - Rule action.escu.search_type = detection @@ -761,7 +761,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success| search userName!=requestParameters.userName | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userName user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter` +search = `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success| search userIdentity.userName!=requestParameters.userName | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter` [ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule] action.escu = 0 @@ -1532,8 +1532,8 @@ action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. action.escu.how_to_implement = action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. -action.escu.creation_date = 2021-01-12 -action.escu.modification_date = 2021-01-12 +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 action.escu.confidence = high action.escu.full_search_name = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule action.escu.search_type = detection @@ -1563,7 +1563,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` +search = `cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` [ESCU - Detect New Open S3 buckets - Rule] action.escu = 0 @@ -1574,8 +1574,8 @@ action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. action.escu.how_to_implement = You must install the AWS App for Splunk. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. -action.escu.creation_date = 2021-01-12 -action.escu.modification_date = 2021-01-12 +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 action.escu.confidence = high action.escu.full_search_name = ESCU - Detect New Open S3 buckets - Rule action.escu.search_type = detection @@ -1605,7 +1605,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` +search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` [ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule] action.escu = 0 @@ -1742,8 +1742,8 @@ action.escu.data_models = [] action.escu.eli5 = This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system. action.escu.how_to_implement = You must install Splunk Microsoft Office 365 add-on. This search works with o365:management:activity action.escu.known_false_positives = Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration. -action.escu.creation_date = 2021-01-12 -action.escu.modification_date = 2021-01-12 +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 action.escu.confidence = high action.escu.full_search_name = ESCU - O365 Bypass MFA via Trusted IP - Rule action.escu.search_type = detection @@ -1773,7 +1773,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy | rex max_match=100 field=ModifiedProperties{}.NewValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | rex max_match=100 field=ModifiedProperties{}.OldValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) |stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature vendor_product vendor_account status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `o365_bypass_mfa_via_trusted_ip_filter` +search = `o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy | rex max_match=100 field=ModifiedProperties{}.NewValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | rex max_match=100 field=ModifiedProperties{}.OldValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) |stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature Workload vendor_account status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `o365_bypass_mfa_via_trusted_ip_filter` [ESCU - O365 Disable MFA - Rule] action.escu = 0 diff --git a/dist/saaws/default/transforms.conf b/dist/saaws/default/transforms.conf index d683fb6aeb..18baa82dbb 100644 --- a/dist/saaws/default/transforms.conf +++ b/dist/saaws/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T17:27:19 UTC +# On Date: 2021-07-20T20:51:41 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/use_case_library.conf b/dist/saaws/default/use_case_library.conf index e3798fefc1..2e23fdb9e2 100644 --- a/dist/saaws/default/use_case_library.conf +++ b/dist/saaws/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T17:27:19 UTC +# On Date: 2021-07-20T20:51:41 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/docs/detections.md b/docs/detections.md index eca20eceee..27e972612f 100644 --- a/docs/detections.md +++ b/docs/detections.md @@ -5946,7 +5946,7 @@ This search looks for AWS CloudTrail events where a user A who has already permi - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: - **ATT&CK**: [T1136.003](https://attack.mitre.org/techniques/T1136/003/) -- **Last Updated**: 2021-03-02 +- **Last Updated**: 2021-07-19
details @@ -5954,7 +5954,7 @@ This search looks for AWS CloudTrail events where a user A who has already permi #### Search ``` `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success -| search userName!=requestParameters.userName +| search userIdentity.userName!=requestParameters.userName | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -6011,7 +6011,7 @@ While this search has no known false positives, it is possible that an AWS admin * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json -_version_: 1 +_version_: 2
--- @@ -6022,7 +6022,7 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: - **ATT&CK**: [T1136.003](https://attack.mitre.org/techniques/T1136/003/) -- **Last Updated**: 2021-03-02 +- **Last Updated**: 2021-07-19
details @@ -6031,10 +6031,10 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l ``` `cloudtrail` eventName = CreateLoginProfile | rename requestParameters.userName as new_login_profile -| table src_ip eventName new_login_profile userName +| table src_ip eventName new_login_profile userIdentity.userName | join new_login_profile src_ip [ | search `cloudtrail` eventName = ConsoleLogin -| rename userName as new_login_profile +| rename userIdentity.userName as new_login_profile | stats count values(eventName) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn new_login_profile src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`] @@ -6091,7 +6091,7 @@ While this search has no known false positives, it is possible that an AWS admin * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createloginprofile/aws_cloudtrail_events.json -_version_: 1 +_version_: 2
--- @@ -7204,7 +7204,7 @@ This search looks for AWS CloudTrail events where a user A who has already permi - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: - **ATT&CK**: [T1136.003](https://attack.mitre.org/techniques/T1136/003/) -- **Last Updated**: 2021-03-02 +- **Last Updated**: 2021-07-19
details @@ -7212,8 +7212,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi #### Search ``` `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success -| search userName!=requestParameters.userName -| stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userName user_arn +| search userIdentity.userName!=requestParameters.userName +| stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`aws_updateloginprofile_filter` @@ -7269,7 +7269,7 @@ While this search has no known false positives, it is possible that an AWS admin * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_updateloginprofile/aws_cloudtrail_events.json -_version_: 1 +_version_: 2
--- @@ -7736,7 +7736,7 @@ To successfully implement this search, you need to be ingesting logs with the pr #### Kill Chain Phase -* Exploitation +* Reconnaissance #### Known False Positives @@ -7846,7 +7846,7 @@ _version_: 1 --- ### Allow Inbound Traffic By Firewall Rule Registry -This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule. - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: Endpoint @@ -7929,7 +7929,7 @@ _version_: 1 --- ### Allow Inbound Traffic In Firewall Rule -This search is to detect suspicious powershell command to allow inbound traffic in specific local port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +The following analytic identifies suspicious PowerShell command to allow inbound traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: Endpoint @@ -8039,14 +8039,14 @@ To successfully implement this search you need to be ingesting information on pr * Processes.user -* Processes.parent_process - * Processes.process_name * Processes.process * Processes.process_id +* Processes.parent_process + * Processes.parent_process_id * Processes.parent_process_name @@ -8088,7 +8088,7 @@ _version_: 1 --- ### Allow Operation with Consent Admin -this search is to detect a potential privilege escalation attempt to do malicious task. This registry modification is designed to allows the Consent Admin to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. +This analytic identifies a potential privilege escalation attempt to perform malicious task. This registry modification is designed to allow the `Consent Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: Endpoint @@ -8367,10 +8367,12 @@ To successfully implement this search you need to be ingesting information on pr * Processes.user -* Processes.parent_process +* Processes.parent_process_name * Processes.process_name +* Processes.parent_process + * Processes.process_id * Processes.parent_process_id @@ -8455,10 +8457,12 @@ To successfully implement this search you need to be ingesting information on pr * Processes.user -* Processes.parent_process +* Processes.parent_process_name * Processes.process_name +* Processes.parent_process + * Processes.process_id * Processes.parent_process_id @@ -8545,10 +8549,12 @@ To successfully implement this search you need to be ingesting information on pr * Processes.user -* Processes.parent_process +* Processes.parent_process_name * Processes.process_name +* Processes.parent_process + * Processes.process_id * Processes.parent_process_id @@ -8881,7 +8887,7 @@ To successfully implement this search, you must be ingesting data that records p * Processes.process_name -* Processes.parent_process_name +* Processes.parent_process @@ -8933,7 +8939,7 @@ Attempt To Add Certificate To Untrusted Store #### Search ``` -| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil* (Processes.process=*-addstore*) by Processes.parent_process Processes.process_name Processes.user +| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil* (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` @@ -8951,13 +8957,21 @@ You must be ingesting data that records process activity from your hosts to popu * _time -* Processes.process +* Processes.dest + +* Processes.user + +* Processes.parent_process_name * Processes.process_name +* Processes.process + * Processes.parent_process -* Processes.user +* Processes.process_id + +* Processes.parent_process_id @@ -8981,6 +8995,10 @@ There may be legitimate reasons for administrators to add a certificate to the u #### Reference +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md + + + #### Test Dataset * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.004/atomic_red_team/windows-sysmon.log @@ -9088,7 +9106,7 @@ This search looks for attempts to stop security-related services on the endpoint #### Search ``` -| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = net.exe OR Processes.process_name = sc.exe) Processes.process="* stop *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user +| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = net.exe OR Processes.process_name = sc.exe) Processes.process="* stop *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -9110,13 +9128,19 @@ You must be ingesting data that records the file-system activity from your hosts * _time +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + * Processes.process_name * Processes.process -* Processes.dest +* Processes.process_id -* Processes.user +* Processes.parent_process_id @@ -9140,6 +9164,10 @@ None identified. Attempts to disable security-related services should be identif #### Reference +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service + + + #### Test Dataset * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log @@ -9244,7 +9272,7 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Search ``` -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest Processes.process_id +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -9264,11 +9292,19 @@ You must be ingesting endpoint data that tracks process activity, including pare * _time +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + * Processes.process_name * Processes.process -* Processes.dest +* Processes.process_id + +* Processes.parent_process_id @@ -9290,6 +9326,10 @@ None identified. #### Reference +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets + + + #### Test Dataset * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log @@ -9484,15 +9524,27 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.parent_process - -* Processes.process_name +* Processes.dest * Processes.user -* Processes.dest +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -9570,15 +9622,27 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.parent_process - -* Processes.process_name +* Processes.dest * Processes.user -* Processes.dest +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -9729,14 +9793,22 @@ To successfully implement this search you need to be ingesting information on pr * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + * Processes.process_name * Processes.process * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + * Processes.parent_process_id @@ -9893,15 +9965,27 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.parent_process - -* Processes.process_name +* Processes.dest * Processes.user -* Processes.dest +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -9975,15 +10059,27 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.parent_process - -* Processes.process_name +* Processes.dest * Processes.user -* Processes.dest +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -10057,15 +10153,27 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.parent_process - -* Processes.process_name +* Processes.dest * Processes.user -* Processes.dest +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -10121,7 +10229,7 @@ This search looks for arguments to certutil.exe indicating the manipulation or e #### Search ``` -| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name Processes.process Processes.user +| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` @@ -10135,19 +10243,33 @@ This search looks for arguments to certutil.exe indicating the manipulation or e #### How To Implement - +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. #### Required field * _time -* Processes.process +* Processes.dest -* Processes.process_name +* Processes.user + +* Processes.parent_process_name * Processes.parent_process -* Processes.user +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -10248,7 +10370,7 @@ _version_: 3 --- ### Clear Unallocated Sector Using Cipher App -this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files. +this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: Endpoint @@ -10273,27 +10395,33 @@ this search is to detect execution of cipher.exe to clear the unallocated sector #### How To Implement -To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. #### Required field * _time +* Processes.dest + +* Processes.user + * Processes.parent_process_name * Processes.parent_process +* Processes.original_file_name + * Processes.process_name * Processes.process -* Processes.dest - -* Processes.user - * Processes.process_id -* Processes.process_guid +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -10317,6 +10445,8 @@ administrator may execute this app to manage disk * https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/ +* https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf + #### Test Dataset @@ -10343,7 +10473,7 @@ The following analytics are designed to identifies some CLOP ransomware variant #### Search ``` -| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name != "*temp.dat*" Processes.process = "*runrun*" OR Processes.process = "*temp.dat*" by Processes.parent_process_name Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid +| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name != "*temp.dat*" Processes.process = "*runrun*" OR Processes.process = "*temp.dat*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -10355,24 +10485,34 @@ The following analytics are designed to identifies some CLOP ransomware variant #### How To Implement -To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. #### Required field -* Processes.process - -* Processes.parent_process_name - * _time -* Processes.process_name - * Processes.dest * Processes.user +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id + #### ATT&CK @@ -11529,19 +11669,27 @@ To successfully implement this search, you need to be ingesting logs with the pr * _time -* Processes.process_name +* Processes.dest -* Processes.process +* Processes.user * Processes.parent_process_name * Processes.parent_process -* Processes.dest Processes.user +* Processes.original_file_name + +* Processes.process_name + +* Processes.process * Processes.process_id -* Processes.process_guid +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -11621,6 +11769,8 @@ This search needs Sysmon Logs with a Sysmon configuration, which includes EventC * TargetProcessId +* dest + #### ATT&CK @@ -11660,7 +11810,7 @@ This detection is to identify a creation of "user mode service" where the servic - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: Endpoint -- **ATT&CK**: [T1569.001](https://attack.mitre.org/techniques/T1569/001/), [T1569.002](https://attack.mitre.org/techniques/T1569/002/) +- **ATT&CK**: [T1569.002](https://attack.mitre.org/techniques/T1569/002/) - **Last Updated**: 2021-03-12
@@ -11702,7 +11852,6 @@ To successfully implement this search, you need to be ingesting logs with the Se | ID | Technique | Tactic | | ----------- | ----------- |--------------| -| T1569.001 | Launchctl | Execution | | T1569.002 | Service Execution | Execution | @@ -11765,15 +11914,27 @@ You must be ingesting data that records process activity from your hosts to popu * _time +* Processes.dest + * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + * Processes.process_name * Processes.process -* Processes.dest +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -11842,15 +12003,27 @@ You must be ingesting data that records process activity from your hosts to popu * _time +* Processes.dest + * Processes.user +* Processes.parent_process_name + * Processes.parent_process -* Processs.process_name +* Processes.original_file_name + +* Processes.process_name * Processes.process -* Processes.dest +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -11918,18 +12091,26 @@ You must be ingesting endpoint data that tracks process activity, including pare * _time -* Processes.process_name - -* Processes.process - * Processes.dest * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + * Processes.parent_process_id @@ -11998,13 +12179,27 @@ To successfully implement this search you need to be ingesting information on pr * _time +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + * Processes.process_name * Processes.process -* Processes.user +* Processes.process_id -* Processes.dest +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -12041,7 +12236,7 @@ _version_: 1 --- ### Creation of lsass Dump with Taskmgr -Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. +Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: @@ -12152,18 +12347,26 @@ You must be ingesting endpoint data that tracks process activity, including pare * _time -* Processes.process_name - -* Processes.process - * Processes.dest * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + * Processes.parent_process_id @@ -12232,18 +12435,26 @@ You must be ingesting endpoint data that tracks process activity, including pare * _time -* Processes.process_name - -* Processes.process - * Processes.dest * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + * Processes.parent_process_id @@ -13176,14 +13387,24 @@ To successfully implement this search, you need to be ingesting logs with the pr * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + * Processes.process_name * Processes.process * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id + #### ATT&CK @@ -13415,13 +13636,19 @@ To successfully implement this search you need to be ingesting information on pr * _time +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + * Processes.process_name * Processes.process -* Processes.user +* Processes.process_id -* Processes.dest +* Processes.parent_process_id @@ -13654,17 +13881,27 @@ To successfully implement this search, you need to be ingesting logs with the pr * _time -* Processes.process_name - * Processes.dest * Processes.user * Processes.parent_process_name +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + * Processes.process_id -* Processes.parent_process +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -13738,17 +13975,27 @@ You must be ingesting endpoint data that tracks process activity, including pare * _time -* Processes.process - -* Processes.parent_process - -* Processes.process_name +* Processes.dest * Processes.user * Processes.parent_process_name -* Processes.dest +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -14352,14 +14599,22 @@ To successfully implement this search you need to be ingesting information on pr * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + * Processes.process_name * Processes.process * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + * Processes.parent_process_id @@ -14901,7 +15156,7 @@ _version_: 1 --- ### Detect Empire with PowerShell Script Block Logging -The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. @@ -15478,20 +15733,26 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.parent_process_name - * Processes.dest * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + * Processes.process_name * Processes.process * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + * Processes.parent_process_id @@ -15568,18 +15829,26 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process_name - -* Processes.process - * Processes.dest * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + * Processes.parent_process_id @@ -15658,18 +15927,28 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process_name - -* Processes.process - * Processes.dest * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id + #### ATT&CK @@ -16004,15 +16283,27 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.parent_process - -* Processes.process_name +* Processes.dest * Processes.user -* Processes.dest +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -16261,6 +16552,8 @@ You must be ingesting Windows event logs using the Splunk Windows TA and collect * dest +* user + #### ATT&CK @@ -16448,7 +16741,7 @@ This search looks for AWS CloudTrail events where a user has created an open/pub - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: - **ATT&CK**: [T1530](https://attack.mitre.org/techniques/T1530/) -- **Last Updated**: 2021-01-12 +- **Last Updated**: 2021-07-19
details @@ -16458,7 +16751,7 @@ This search looks for AWS CloudTrail events where a user has created an open/pub `cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull -| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control +| stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` @@ -16489,7 +16782,7 @@ This search looks for AWS CloudTrail events where a user has created an open/pub * requestParameters.bucketName -* userName +* userIdentity.userName * userIdentity.principalId @@ -16522,7 +16815,7 @@ While this search has no known false positives, it is possible that an AWS admin * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events.json -_version_: 1 +_version_: 2
--- @@ -16533,7 +16826,7 @@ This search looks for AWS CloudTrail events where a user has created an open/pub - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: - **ATT&CK**: [T1530](https://attack.mitre.org/techniques/T1530/) -- **Last Updated**: 2021-01-12 +- **Last Updated**: 2021-07-19
details @@ -16550,7 +16843,7 @@ This search looks for AWS CloudTrail events where a user has created an open/pub | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName -| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId userAgent uri permission bucketName +| stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` @@ -16573,7 +16866,7 @@ You must install the AWS App for Splunk. * requestParameters.bucketName -* userName +* userIdentity.userName * userIdentity.principalId @@ -16608,7 +16901,7 @@ While this search has no known false positives, it is possible that an AWS admin * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events.json -_version_: 2 +_version_: 3
--- @@ -16897,15 +17190,27 @@ You must be ingesting data that records process activity from your hosts to popu * _time -* Processes.parent_process_name +* Processes.dest * Processes.user +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + * Processes.process_name * Processes.process -* Processes.dest +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -17068,16 +17373,28 @@ You must be ingesting data that records process activity from your hosts and pop * _time -* Processes.process - -* Processes.process_name - -* Processes.parent_process_name - * Processes.dest * Processes.user +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id + #### ATT&CK @@ -17202,7 +17519,7 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla #### Search ``` -| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*psexec* Processes.process=*accepteula* by Processes.process_name Processes.dest Processes.parent_process_name +| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*psexec* Processes.process=*accepteula* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -17228,13 +17545,27 @@ You must be ingesting data that records process activity from your hosts to popu * _time -* Processes.process +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name * Processes.process_name -* Processes.dest +* Processes.process -* Processes.parent_process_name +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -17988,18 +18319,26 @@ You must be ingesting endpoint data that tracks process activity, including pare * _time -* Processes.process_name - -* Processes.process - * Processes.dest * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + * Processes.parent_process_id @@ -18475,7 +18814,7 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack #### Search ``` -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*advpack* by Processes.user Processes.process_name Processes.process Processes.dest +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*advpack* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -18493,13 +18832,19 @@ To successfully implement this search you need to be ingesting information on pr * _time +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + * Processes.process_name * Processes.process -* Processes.user +* Processes.process_id -* Processes.dest +* Processes.parent_process_id @@ -18557,7 +18902,7 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa #### Search ``` -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*setupapi* by Processes.user Processes.process_name Processes.process Processes.dest +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*setupapi* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -18575,13 +18920,19 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.process_name +* Processes.dest * Processes.user -* Processes.dest +* Processes.parent_process_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id @@ -18639,7 +18990,7 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t #### Search ``` -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*syssetup* by Processes.user Processes.process_name Processes.process Processes.dest +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*syssetup* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -18657,13 +19008,19 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.process_name +* Processes.dest * Processes.user -* Processes.dest +* Processes.parent_process_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id @@ -20354,17 +20711,27 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.parent_process +* Processes.dest * Processes.user -* Processes.process_name - * Processes.parent_process_name -* Processes.dest +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -20524,15 +20891,27 @@ You must be ingesting data that records registry activity from your hosts to pop * _time -* Processes.process +* Processes.dest + +* Processes.user + +* Processes.parent_process_name * Processes.parent_process -* Processes.dest +* Processes.original_file_name * Processes.process_name -* Processes.user +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -20955,7 +21334,7 @@ _version_: 1 --- ### Disable Registry Tool -This search is to identifies modification of registry to disable the regedit or registry tools of windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. +This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: Endpoint @@ -21035,7 +21414,7 @@ _version_: 1 --- ### Disable Show Hidden Files -The following search is to idetifies a modification in registry to prevent the user seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. +The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: Endpoint @@ -22188,13 +22567,19 @@ You must be ingesting endpoint data that tracks process activity, including pare * _time +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + * Processes.process_name * Processes.process -* Processes.user +* Processes.process_id -* Processes.dest +* Processes.parent_process_id @@ -22267,13 +22652,19 @@ To successfully implement this search you need to be ingesting information on pr * _time +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + * Processes.process_name * Processes.process -* Processes.user +* Processes.process_id -* Processes.dest +* Processes.parent_process_id @@ -29100,7 +29491,7 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: - **ATT&CK**: [T1562.007](https://attack.mitre.org/techniques/T1562/007/) -- **Last Updated**: 2021-01-12 +- **Last Updated**: 2021-07-19
details @@ -29113,7 +29504,7 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) -|stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature vendor_product vendor_account status user_id action +|stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature Workload vendor_account status user_id action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_bypass_mfa_via_trusted_ip_filter` @@ -29140,8 +29531,6 @@ You must install Splunk Microsoft Office 365 add-on. This search works with o365 * user -* vendor_product - * vendor_account * status @@ -29181,7 +29570,7 @@ Unless it is a special case, it is uncommon to continually update Trusted IPs to * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/o365_bypass_mfa_via_trusted_ip/o365_bypass_mfa_via_trusted_ip.json -_version_: 1 +_version_: 2
--- @@ -31120,7 +31509,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Search ``` -`powershell` EventCode=4104 Message="*[system.reflection.assembly]::load(*" +`powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*") | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -31163,7 +31552,7 @@ To successfully implement this analytic, you will need to enable PowerShell Scri #### Known False Positives -False positives will be limited to +False positives should be limited as day to day scripts do not use this method. #### Reference @@ -38616,7 +39005,7 @@ This analytic will detect suspicious driver loaded paths. This technique is comm #### Search ``` `sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) -| stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature Signed +| stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_driver_loaded_path_filter` diff --git a/docs/detections.wiki b/docs/detections.wiki index ada2501043..c11a11d127 100644 --- a/docs/detections.wiki +++ b/docs/detections.wiki @@ -1096,14 +1096,14 @@ This search looks for AWS CloudTrail events where a user A who has already permi * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/003/ T1136.003] -* '''Last Updated''': 2021-03-02 +* '''Last Updated''': 2021-07-19
====Search==== `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success -| search userName!=requestParameters.userName +| search userIdentity.userName!=requestParameters.userName | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -1165,7 +1165,7 @@ While this search has no known false positives, it is possible that an AWS admin * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json -''version'': 1 +''version'': 2
@@ -1177,7 +1177,7 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/003/ T1136.003] -* '''Last Updated''': 2021-03-02 +* '''Last Updated''': 2021-07-19
@@ -1185,10 +1185,10 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l ====Search==== `cloudtrail` eventName = CreateLoginProfile | rename requestParameters.userName as new_login_profile -| table src_ip eventName new_login_profile userName +| table src_ip eventName new_login_profile userIdentity.userName | join new_login_profile src_ip [ | search `cloudtrail` eventName = ConsoleLogin -| rename userName as new_login_profile +| rename userIdentity.userName as new_login_profile | stats count values(eventName) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn new_login_profile src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`] @@ -1250,7 +1250,7 @@ While this search has no known false positives, it is possible that an AWS admin * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createloginprofile/aws_cloudtrail_events.json -''version'': 1 +''version'': 2
@@ -2435,15 +2435,15 @@ This search looks for AWS CloudTrail events where a user A who has already permi * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/003/ T1136.003] -* '''Last Updated''': 2021-03-02 +* '''Last Updated''': 2021-07-19
====Search==== `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success -| search userName!=requestParameters.userName -| stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userName user_arn +| search userIdentity.userName!=requestParameters.userName +| stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`aws_updateloginprofile_filter` @@ -2504,7 +2504,7 @@ While this search has no known false positives, it is possible that an AWS admin * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_updateloginprofile/aws_cloudtrail_events.json -''version'': 1 +''version'': 2
@@ -4322,7 +4322,7 @@ This search looks for AWS CloudTrail events where a user has created an open/pub * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1530/ T1530] -* '''Last Updated''': 2021-01-12 +* '''Last Updated''': 2021-07-19
@@ -4331,7 +4331,7 @@ This search looks for AWS CloudTrail events where a user has created an open/pub `cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull -| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control +| stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` @@ -4362,7 +4362,7 @@ This search looks for AWS CloudTrail events where a user has created an open/pub * requestParameters.bucketName -* userName +* userIdentity.userName * userIdentity.principalId @@ -4400,7 +4400,7 @@ While this search has no known false positives, it is possible that an AWS admin * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events.json -''version'': 1 +''version'': 2
@@ -4412,7 +4412,7 @@ This search looks for AWS CloudTrail events where a user has created an open/pub * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1530/ T1530] -* '''Last Updated''': 2021-01-12 +* '''Last Updated''': 2021-07-19
@@ -4428,7 +4428,7 @@ This search looks for AWS CloudTrail events where a user has created an open/pub | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName -| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId userAgent uri permission bucketName +| stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` @@ -4451,7 +4451,7 @@ You must install the AWS App for Splunk. * requestParameters.bucketName -* userName +* userIdentity.userName * userIdentity.principalId @@ -4491,7 +4491,7 @@ While this search has no known false positives, it is possible that an AWS admin * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events.json -''version'': 2 +''version'': 3
@@ -5428,7 +5428,7 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/007/ T1562.007] -* '''Last Updated''': 2021-01-12 +* '''Last Updated''': 2021-07-19
@@ -5440,7 +5440,7 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) -|stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature vendor_product vendor_account status user_id action +|stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature Workload vendor_account status user_id action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_bypass_mfa_via_trusted_ip_filter` @@ -5467,8 +5467,6 @@ You must install Splunk Microsoft Office 365 add-on. This search works with o365 * user -* vendor_product - * vendor_account * status @@ -5513,7 +5511,7 @@ Unless it is a special case, it is uncommon to continually update Trusted IPs to * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/o365_bypass_mfa_via_trusted_ip/o365_bypass_mfa_via_trusted_ip.json -''version'': 1 +''version'': 2
@@ -6741,7 +6739,7 @@ To successfully implement this search, you need to be ingesting logs with the pr ====Kill Chain Phase==== -* Exploitation +* Reconnaissance ====Known False Positives==== @@ -6857,7 +6855,7 @@ network admin may modify this firewall feature that may cause this rule to be tr ---- ===Allow inbound traffic by firewall rule registry=== -This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint @@ -6945,7 +6943,7 @@ network admin may add/remove/modify public inbound firewall rule that may cause ---- ===Allow inbound traffic in firewall rule=== -This search is to detect suspicious powershell command to allow inbound traffic in specific local port with public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +The following analytic identifies suspicious PowerShell command to allow inbound traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint @@ -7059,14 +7057,14 @@ To successfully implement this search you need to be ingesting information on pr * Processes.user -* Processes.parent_process - * Processes.process_name * Processes.process * Processes.process_id +* Processes.parent_process + * Processes.parent_process_id * Processes.parent_process_name @@ -7114,7 +7112,7 @@ network admin may modify this firewall feature that may cause this rule to be tr ---- ===Allow operation with consent admin=== -this search is to detect a potential privilege escalation attempt to do malicious task. This registry modification is designed to allows the Consent Admin to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. +This analytic identifies a potential privilege escalation attempt to perform malicious task. This registry modification is designed to allow the `Consent Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint @@ -7235,10 +7233,12 @@ To successfully implement this search you need to be ingesting information on pr * Processes.user -* Processes.parent_process +* Processes.parent_process_name * Processes.process_name +* Processes.parent_process + * Processes.process_id * Processes.parent_process_id @@ -7328,10 +7328,12 @@ To successfully implement this search you need to be ingesting information on pr * Processes.user -* Processes.parent_process +* Processes.parent_process_name * Processes.process_name +* Processes.parent_process + * Processes.process_id * Processes.parent_process_id @@ -7423,10 +7425,12 @@ To successfully implement this search you need to be ingesting information on pr * Processes.user -* Processes.parent_process +* Processes.parent_process_name * Processes.process_name +* Processes.parent_process + * Processes.process_id * Processes.parent_process_id @@ -7854,7 +7858,7 @@ To successfully implement this search, you must be ingesting data that records p * Processes.process_name -* Processes.parent_process_name +* Processes.parent_process @@ -7917,7 +7921,7 @@ Attempt To Add Certificate To Untrusted Store ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil* (Processes.process=*-addstore*) by Processes.parent_process Processes.process_name Processes.user +| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil* (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` @@ -7935,13 +7939,21 @@ You must be ingesting data that records process activity from your hosts to popu * _time -* Processes.process +* Processes.dest + +* Processes.user + +* Processes.parent_process_name * Processes.process_name +* Processes.process + * Processes.parent_process -* Processes.user +* Processes.process_id + +* Processes.parent_process_id @@ -7970,6 +7982,10 @@ There may be legitimate reasons for administrators to add a certificate to the u ====Reference==== +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md + + + ====Test Dataset==== * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.004/atomic_red_team/windows-sysmon.log @@ -8082,7 +8098,7 @@ This search looks for attempts to stop security-related services on the endpoint ====Search==== -| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = net.exe OR Processes.process_name = sc.exe) Processes.process="* stop *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user +| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = net.exe OR Processes.process_name = sc.exe) Processes.process="* stop *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -8104,13 +8120,19 @@ You must be ingesting data that records the file-system activity from your hosts * _time +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + * Processes.process_name * Processes.process -* Processes.dest +* Processes.process_id -* Processes.user +* Processes.parent_process_id @@ -8139,6 +8161,10 @@ None identified. Attempts to disable security-related services should be identif ====Reference==== +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service + + + ====Test Dataset==== * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log @@ -8248,7 +8274,7 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest Processes.process_id +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -8268,11 +8294,19 @@ You must be ingesting endpoint data that tracks process activity, including pare * _time +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + * Processes.process_name * Processes.process -* Processes.dest +* Processes.process_id + +* Processes.parent_process_id @@ -8299,6 +8333,10 @@ None identified. ====Reference==== +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets + + + ====Test Dataset==== * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log @@ -8503,15 +8541,27 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.parent_process - -* Processes.process_name +* Processes.dest * Processes.user -* Processes.dest +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -8594,15 +8644,27 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.parent_process - -* Processes.process_name +* Processes.dest * Processes.user -* Processes.dest +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -8766,14 +8828,22 @@ To successfully implement this search you need to be ingesting information on pr * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + * Processes.process_name * Processes.process * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + * Processes.parent_process_id @@ -8943,15 +9013,27 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.parent_process - -* Processes.process_name +* Processes.dest * Processes.user -* Processes.dest +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -9030,15 +9112,27 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.parent_process - -* Processes.process_name +* Processes.dest * Processes.user -* Processes.dest +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -9117,15 +9211,27 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.parent_process - -* Processes.process_name +* Processes.dest * Processes.user -* Processes.dest +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -9186,7 +9292,7 @@ This search looks for arguments to certutil.exe indicating the manipulation or e ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name Processes.process Processes.user +| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` @@ -9200,19 +9306,33 @@ This search looks for arguments to certutil.exe indicating the manipulation or e ====How To Implement==== - +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. ====Required field==== * _time -* Processes.process +* Processes.dest -* Processes.process_name +* Processes.user + +* Processes.parent_process_name * Processes.parent_process -* Processes.user +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -9319,7 +9439,7 @@ Some legitimate printer-related processes may show up as children of spoolsv.exe ---- ===Clear unallocated sector using cipher app=== -this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files. +this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint @@ -9343,27 +9463,33 @@ this search is to detect execution of cipher.exe to clear the unallocated sector ====How To Implement==== -To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. ====Required field==== * _time +* Processes.dest + +* Processes.user + * Processes.parent_process_name * Processes.parent_process +* Processes.original_file_name + * Processes.process_name * Processes.process -* Processes.dest - -* Processes.user - * Processes.process_id -* Processes.process_guid +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -9392,6 +9518,8 @@ administrator may execute this app to manage disk * https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/ +* https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf + ====Test Dataset==== @@ -9418,7 +9546,7 @@ The following analytics are designed to identifies some CLOP ransomware variant ====Search==== -| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name != "*temp.dat*" Processes.process = "*runrun*" OR Processes.process = "*temp.dat*" by Processes.parent_process_name Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid +| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name != "*temp.dat*" Processes.process = "*runrun*" OR Processes.process = "*temp.dat*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -9430,24 +9558,34 @@ The following analytics are designed to identifies some CLOP ransomware variant ====How To Implement==== -To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. ====Required field==== -* Processes.process - -* Processes.parent_process_name - * _time -* Processes.process_name - * Processes.dest * Processes.user +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id + ====ATT&CK==== @@ -9872,19 +10010,27 @@ To successfully implement this search, you need to be ingesting logs with the pr * _time -* Processes.process_name +* Processes.dest -* Processes.process +* Processes.user * Processes.parent_process_name * Processes.parent_process -* Processes.dest Processes.user +* Processes.original_file_name + +* Processes.process_name + +* Processes.process * Processes.process_id -* Processes.process_guid +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -9969,6 +10115,8 @@ This search needs Sysmon Logs with a Sysmon configuration, which includes EventC * TargetProcessId +* dest + ====ATT&CK==== @@ -10014,7 +10162,7 @@ This detection is to identify a creation of "user mode service" where the servic * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569/001/ T1569.001], [https://attack.mitre.org/techniques/T1569/002/ T1569.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569/002/ T1569.002] * '''Last Updated''': 2021-03-12
@@ -10057,10 +10205,6 @@ To successfully implement this search, you need to be ingesting logs with the Se ! Technique ! Tactic |- -| T1569.001 -| Launchctl -| Execution -|- | T1569.002 | Service Execution | Execution @@ -10126,15 +10270,27 @@ You must be ingesting data that records process activity from your hosts to popu * _time +* Processes.dest + * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + * Processes.process_name * Processes.process -* Processes.dest +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -10208,15 +10364,27 @@ You must be ingesting data that records process activity from your hosts to popu * _time +* Processes.dest + * Processes.user +* Processes.parent_process_name + * Processes.parent_process -* Processs.process_name +* Processes.original_file_name + +* Processes.process_name * Processes.process -* Processes.dest +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -10289,18 +10457,26 @@ You must be ingesting endpoint data that tracks process activity, including pare * _time -* Processes.process_name - -* Processes.process - * Processes.dest * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + * Processes.parent_process_id @@ -10374,13 +10550,27 @@ To successfully implement this search you need to be ingesting information on pr * _time +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + * Processes.process_name * Processes.process -* Processes.user +* Processes.process_id -* Processes.dest +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -10423,7 +10613,7 @@ Legtimate administrator usage of wmic to create a shadow copy. ---- ===Creation of lsass dump with taskmgr=== -Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. +Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': @@ -10538,18 +10728,26 @@ You must be ingesting endpoint data that tracks process activity, including pare * _time -* Processes.process_name - -* Processes.process - * Processes.dest * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + * Processes.parent_process_id @@ -10623,18 +10821,26 @@ You must be ingesting endpoint data that tracks process activity, including pare * _time -* Processes.process_name - -* Processes.process - * Processes.dest * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + * Processes.parent_process_id @@ -11630,14 +11836,24 @@ To successfully implement this search, you need to be ingesting logs with the pr * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + * Processes.process_name * Processes.process * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id + ====ATT&CK==== @@ -11718,13 +11934,19 @@ To successfully implement this search you need to be ingesting information on pr * _time +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + * Processes.process_name * Processes.process -* Processes.user +* Processes.process_id -* Processes.dest +* Processes.parent_process_id @@ -11972,17 +12194,27 @@ To successfully implement this search, you need to be ingesting logs with the pr * _time -* Processes.process_name - * Processes.dest * Processes.user * Processes.parent_process_name +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + * Processes.process_id -* Processes.parent_process +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -12061,17 +12293,27 @@ You must be ingesting endpoint data that tracks process activity, including pare * _time -* Processes.process - -* Processes.parent_process - -* Processes.process_name +* Processes.dest * Processes.user * Processes.parent_process_name -* Processes.dest +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -12306,14 +12548,22 @@ To successfully implement this search you need to be ingesting information on pr * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + * Processes.process_name * Processes.process * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + * Processes.parent_process_id @@ -12920,7 +13170,7 @@ None identified. ---- ===Detect empire with powershell script block logging=== -The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. @@ -13372,20 +13622,26 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.parent_process_name - * Processes.dest * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + * Processes.process_name * Processes.process * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + * Processes.parent_process_id @@ -13467,18 +13723,26 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process_name - -* Processes.process - * Processes.dest * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + * Processes.parent_process_id @@ -13562,18 +13826,28 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process_name - -* Processes.process - * Processes.dest * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id + ====ATT&CK==== @@ -13737,15 +14011,27 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.parent_process - -* Processes.process_name +* Processes.dest * Processes.user -* Processes.dest +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -14009,6 +14295,8 @@ You must be ingesting Windows event logs using the Splunk Windows TA and collect * dest +* user + ====ATT&CK==== @@ -14264,15 +14552,27 @@ You must be ingesting data that records process activity from your hosts to popu * _time -* Processes.parent_process_name +* Processes.dest * Processes.user +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + * Processes.process_name * Processes.process -* Processes.dest +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -14352,16 +14652,28 @@ You must be ingesting data that records process activity from your hosts and pop * _time -* Processes.process - -* Processes.process_name - -* Processes.parent_process_name - * Processes.dest * Processes.user +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id + ====ATT&CK==== @@ -14496,7 +14808,7 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla ====Search==== -| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*psexec* Processes.process=*accepteula* by Processes.process_name Processes.dest Processes.parent_process_name +| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*psexec* Processes.process=*accepteula* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -14522,13 +14834,27 @@ You must be ingesting data that records process activity from your hosts to popu * _time -* Processes.process +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name * Processes.process_name -* Processes.dest +* Processes.process -* Processes.parent_process_name +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -15322,18 +15648,26 @@ You must be ingesting endpoint data that tracks process activity, including pare * _time -* Processes.process_name - -* Processes.process - * Processes.dest * Processes.user +* Processes.parent_process_name + * Processes.parent_process +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + * Processes.process_id +* Processes.parent_process_path + +* Processes.process_path + * Processes.parent_process_id @@ -15759,7 +16093,7 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*advpack* by Processes.user Processes.process_name Processes.process Processes.dest +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*advpack* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -15777,13 +16111,19 @@ To successfully implement this search you need to be ingesting information on pr * _time +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + * Processes.process_name * Processes.process -* Processes.user +* Processes.process_id -* Processes.dest +* Processes.parent_process_id @@ -15846,7 +16186,7 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*setupapi* by Processes.user Processes.process_name Processes.process Processes.dest +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*setupapi* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -15864,13 +16204,19 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.process_name +* Processes.dest * Processes.user -* Processes.dest +* Processes.parent_process_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id @@ -15933,7 +16279,7 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*syssetup* by Processes.user Processes.process_name Processes.process Processes.dest +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*syssetup* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -15951,13 +16297,19 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.process_name +* Processes.dest * Processes.user -* Processes.dest +* Processes.parent_process_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id @@ -16626,17 +16978,27 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.process - -* Processes.parent_process +* Processes.dest * Processes.user -* Processes.process_name - * Processes.parent_process_name -* Processes.dest +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -16806,15 +17168,27 @@ You must be ingesting data that records registry activity from your hosts to pop * _time -* Processes.process +* Processes.dest + +* Processes.user + +* Processes.parent_process_name * Processes.parent_process -* Processes.dest +* Processes.original_file_name * Processes.process_name -* Processes.user +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id @@ -17268,7 +17642,7 @@ network operator may use this approach to quickly disable an account but not a c ---- ===Disable registry tool=== -This search is to identifies modification of registry to disable the regedit or registry tools of windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. +This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint @@ -17353,7 +17727,7 @@ admin may disable this application for non technical user. ---- ===Disable show hidden files=== -The following search is to idetifies a modification in registry to prevent the user seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. +The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint @@ -18578,13 +18952,19 @@ You must be ingesting endpoint data that tracks process activity, including pare * _time +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + * Processes.process_name * Processes.process -* Processes.user +* Processes.process_id -* Processes.dest +* Processes.parent_process_id @@ -18662,13 +19042,19 @@ To successfully implement this search you need to be ingesting information on pr * _time +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + * Processes.process_name * Processes.process -* Processes.user +* Processes.process_id -* Processes.dest +* Processes.parent_process_id @@ -25631,7 +26017,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It
====Search==== -`powershell` EventCode=4104 Message="*[system.reflection.assembly]::load(*" +`powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*") | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -25679,7 +26065,7 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ====Known False Positives==== -False positives will be limited to +False positives should be limited as day to day scripts do not use this method. ====Reference==== @@ -33039,7 +33425,7 @@ This analytic will detect suspicious driver loaded paths. This technique is comm ====Search==== `sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) -| stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature Signed +| stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_driver_loaded_path_filter` @@ -41074,7 +41460,7 @@ There might be false positives associted with this detection since items like ar 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
-# On Date: 2021-07-20 17:40:48.975282 UTC''
+# On Date: 2021-07-20 21:03:22.818639 UTC''
 # Author: Splunk Security Research''
 # Contact: research@splunk.com''
 #############
diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv
index b2fb3b3bce..dc5990997a 100644
--- a/docs/mitre-map/coverage.csv
+++ b/docs/mitre-map/coverage.csv
@@ -583,7 +583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -917,8 +917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -1683,7 +1683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -2017,8 +2017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -2783,7 +2783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -3117,8 +3117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -3883,7 +3883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -4217,8 +4217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -4983,7 +4983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -5317,8 +5317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -6083,7 +6083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -6417,8 +6417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -7183,7 +7183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -7517,8 +7517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -8283,7 +8283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -8617,8 +8617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -9383,7 +9383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -9717,8 +9717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -10483,7 +10483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -10817,8 +10817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -11583,7 +11583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -11917,8 +11917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -12683,7 +12683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -13017,8 +13017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -13783,7 +13783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -14117,8 +14117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -14883,7 +14883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -15217,8 +15217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -15983,7 +15983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -16317,8 +16317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -17083,7 +17083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -17417,8 +17417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -18183,7 +18183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -18517,8 +18517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -19283,7 +19283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -19617,8 +19617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -20383,7 +20383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -20717,8 +20717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -21483,7 +21483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -21817,8 +21817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -22583,7 +22583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -22917,8 +22917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -23683,7 +23683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -24017,8 +24017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -24783,7 +24783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -25117,8 +25117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -25883,7 +25883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -26217,8 +26217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -26983,7 +26983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -27317,8 +27317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -28083,7 +28083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -28417,8 +28417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -29183,7 +29183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -29517,8 +29517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -30283,7 +30283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -30617,8 +30617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -31383,7 +31383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -31717,8 +31717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -32483,7 +32483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -32817,8 +32817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -33583,7 +33583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -33917,8 +33917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -34683,7 +34683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -35017,8 +35017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -35783,7 +35783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -36117,8 +36117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -36883,7 +36883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -37217,8 +37217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -37983,7 +37983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -38317,8 +38317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -39083,7 +39083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -39417,8 +39417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -40183,7 +40183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -40517,8 +40517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -41283,7 +41283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -41617,8 +41617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -42383,7 +42383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -42717,8 +42717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -43483,7 +43483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -43817,8 +43817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -44583,7 +44583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -44917,8 +44917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -45683,7 +45683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -46017,8 +46017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -46783,7 +46783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -47117,8 +47117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -47883,7 +47883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -48217,8 +48217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -48983,7 +48983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -49317,8 +49317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -50083,7 +50083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -50417,8 +50417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -51183,7 +51183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -51517,8 +51517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -52283,7 +52283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -52617,8 +52617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -53383,7 +53383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -53717,8 +53717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -54483,7 +54483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -54817,8 +54817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -55583,7 +55583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -55917,8 +55917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -56683,7 +56683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -57017,8 +57017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -57783,7 +57783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -58117,8 +58117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -58883,7 +58883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -59217,8 +59217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -59983,7 +59983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -60317,8 +60317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -61083,7 +61083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -61417,8 +61417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -62183,7 +62183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -62517,8 +62517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -63283,7 +63283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -63617,8 +63617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -64383,7 +64383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -64717,8 +64717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -65483,7 +65483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -65817,8 +65817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -66583,7 +66583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -66917,8 +66917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -67683,7 +67683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -68017,8 +68017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -68783,7 +68783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -69117,8 +69117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -69883,7 +69883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -70217,8 +70217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -70983,7 +70983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -71317,8 +71317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -72083,7 +72083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -72417,8 +72417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -73183,7 +73183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -73517,8 +73517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -74283,7 +74283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -74617,8 +74617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -75383,7 +75383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -75717,8 +75717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -76483,7 +76483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -76817,8 +76817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -77583,7 +77583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -77917,8 +77917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -78683,7 +78683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -79017,8 +79017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -79783,7 +79783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -80117,8 +80117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -80883,7 +80883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -81217,8 +81217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -81983,7 +81983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -82317,8 +82317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -83083,7 +83083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -83417,8 +83417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -84183,7 +84183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -84517,8 +84517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -85283,7 +85283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -85617,8 +85617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -86383,7 +86383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -86717,8 +86717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -87483,7 +87483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -87817,8 +87817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -88583,7 +88583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -88917,8 +88917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -89683,7 +89683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -90017,8 +90017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -90783,7 +90783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -91117,8 +91117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -91883,7 +91883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -92217,8 +92217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -92983,7 +92983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -93317,8 +93317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -94083,7 +94083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -94417,8 +94417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -95183,7 +95183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -95517,8 +95517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -96283,7 +96283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -96617,8 +96617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -97383,7 +97383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -97717,8 +97717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -98483,7 +98483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -98817,8 +98817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -99583,7 +99583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -99917,8 +99917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -100683,7 +100683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -101017,8 +101017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -101783,7 +101783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -102117,8 +102117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -102883,7 +102883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -103217,8 +103217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -103983,7 +103983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -104317,8 +104317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -105083,7 +105083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -105417,8 +105417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -106183,7 +106183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -106517,8 +106517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -107283,7 +107283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -107617,8 +107617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -108383,7 +108383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -108717,8 +108717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -109483,7 +109483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -109817,8 +109817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -110583,7 +110583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -110917,8 +110917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -111683,7 +111683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -112017,8 +112017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -112783,7 +112783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -113117,8 +113117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -113883,7 +113883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -114217,8 +114217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -114983,7 +114983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -115317,8 +115317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -116083,7 +116083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -116417,8 +116417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -117183,7 +117183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -117517,8 +117517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -118283,7 +118283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -118617,8 +118617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -119383,7 +119383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -119717,8 +119717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -120483,7 +120483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -120817,8 +120817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -121583,7 +121583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -121917,8 +121917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -122683,7 +122683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -123017,8 +123017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -123783,7 +123783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -124117,8 +124117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -124883,7 +124883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -125217,8 +125217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -125983,7 +125983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -126317,8 +126317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -127083,7 +127083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -127417,8 +127417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -128183,7 +128183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -128517,8 +128517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -129283,7 +129283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -129617,8 +129617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -130383,7 +130383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -130717,8 +130717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -131483,7 +131483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -131817,8 +131817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -132583,7 +132583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -132917,8 +132917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -133683,7 +133683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -134017,8 +134017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -134783,7 +134783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -135117,8 +135117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -135883,7 +135883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -136217,8 +136217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -136983,7 +136983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -137317,8 +137317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -138083,7 +138083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -138417,8 +138417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -139183,7 +139183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -139517,8 +139517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -140283,7 +140283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -140617,8 +140617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -141383,7 +141383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -141717,8 +141717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -142483,7 +142483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -142817,8 +142817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -143583,7 +143583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -143917,8 +143917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -144683,7 +144683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -145017,8 +145017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -145783,7 +145783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -146117,8 +146117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -146883,7 +146883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -147217,8 +147217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -147983,7 +147983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -148317,8 +148317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -149083,7 +149083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -149417,8 +149417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -150183,7 +150183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -150517,8 +150517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -151283,7 +151283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -151617,8 +151617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -152383,7 +152383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -152717,8 +152717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -153483,7 +153483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -153817,8 +153817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -154583,7 +154583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -154917,8 +154917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -155683,7 +155683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -156017,8 +156017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -156783,7 +156783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -157117,8 +157117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -157883,7 +157883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -158217,8 +158217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -158983,7 +158983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -159317,8 +159317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -160083,7 +160083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -160417,8 +160417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -161183,7 +161183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -161517,8 +161517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -162283,7 +162283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -162617,8 +162617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -163383,7 +163383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -163717,8 +163717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -164483,7 +164483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -164817,8 +164817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -165583,7 +165583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -165917,8 +165917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -166683,7 +166683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -167017,8 +167017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -167783,7 +167783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -168117,8 +168117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -168883,7 +168883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -169217,8 +169217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -169983,7 +169983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -170317,8 +170317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -171083,7 +171083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -171417,8 +171417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -172183,7 +172183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -172517,8 +172517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -173283,7 +173283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -173617,8 +173617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -174383,7 +174383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -174717,8 +174717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -175483,7 +175483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -175817,8 +175817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -176583,7 +176583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -176917,8 +176917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -177683,7 +177683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -178017,8 +178017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -178783,7 +178783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -179117,8 +179117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -179883,7 +179883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -180217,8 +180217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -180983,7 +180983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -181317,8 +181317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -182083,7 +182083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -182417,8 +182417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -183183,7 +183183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -183517,8 +183517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -184283,7 +184283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -184617,8 +184617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -185383,7 +185383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -185717,8 +185717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -186483,7 +186483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -186817,8 +186817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -187583,7 +187583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -187917,8 +187917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -188683,7 +188683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -189017,8 +189017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -189783,7 +189783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -190117,8 +190117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -190883,7 +190883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -191217,8 +191217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -191983,7 +191983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -192317,8 +192317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -193083,7 +193083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -193417,8 +193417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -194183,7 +194183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -194517,8 +194517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -195283,7 +195283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -195617,8 +195617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -196383,7 +196383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -196717,8 +196717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -197483,7 +197483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -197817,8 +197817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -198583,7 +198583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -198917,8 +198917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -199683,7 +199683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -200017,8 +200017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -200783,7 +200783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -201117,8 +201117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -201883,7 +201883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -202217,8 +202217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -202983,7 +202983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -203317,8 +203317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -204083,7 +204083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -204417,8 +204417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -205183,7 +205183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -205517,8 +205517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -206283,7 +206283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -206617,8 +206617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -207383,7 +207383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -207717,8 +207717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -208483,7 +208483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -208817,8 +208817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -209583,7 +209583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -209917,8 +209917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -210683,7 +210683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -211017,8 +211017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -211783,7 +211783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -212117,8 +212117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -212883,7 +212883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -213217,8 +213217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -213983,7 +213983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -214317,8 +214317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -215083,7 +215083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -215417,8 +215417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -216183,7 +216183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -216517,8 +216517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -217283,7 +217283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -217617,8 +217617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -218383,7 +218383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -218717,8 +218717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -219483,7 +219483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -219817,8 +219817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -220583,7 +220583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -220917,8 +220917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -221683,7 +221683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -222017,8 +222017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -222783,7 +222783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -223117,8 +223117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -223883,7 +223883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -224217,8 +224217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -224983,7 +224983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -225317,8 +225317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -226083,7 +226083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -226417,8 +226417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -227183,7 +227183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -227517,8 +227517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -228283,7 +228283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -228617,8 +228617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -229383,7 +229383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -229717,8 +229717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -230483,7 +230483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -230817,8 +230817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -231583,7 +231583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -231917,8 +231917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -232683,7 +232683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -233017,8 +233017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -233783,7 +233783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -234117,8 +234117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -234883,7 +234883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -235217,8 +235217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -235983,7 +235983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -236317,8 +236317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -237083,7 +237083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -237417,8 +237417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -238183,7 +238183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -238517,8 +238517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -239283,7 +239283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -239617,8 +239617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -240383,7 +240383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -240717,8 +240717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -241483,7 +241483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -241817,8 +241817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -242583,7 +242583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -242917,8 +242917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -243683,7 +243683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -244017,8 +244017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -244783,7 +244783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -245117,8 +245117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -245883,7 +245883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -246217,8 +246217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -246983,7 +246983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -247317,8 +247317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -248083,7 +248083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -248417,8 +248417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -249183,7 +249183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -249517,8 +249517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -250283,7 +250283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -250617,8 +250617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -251383,7 +251383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -251717,8 +251717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -252483,7 +252483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -252817,8 +252817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -253583,7 +253583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -253917,8 +253917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -254683,7 +254683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -255017,8 +255017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -255783,7 +255783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -256117,8 +256117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -256883,7 +256883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -257217,8 +257217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -257983,7 +257983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -258317,8 +258317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -259083,7 +259083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -259417,8 +259417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -260183,7 +260183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -260517,8 +260517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -261283,7 +261283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -261617,8 +261617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -262383,7 +262383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -262717,8 +262717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -263483,7 +263483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -263817,8 +263817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -264583,7 +264583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -264917,8 +264917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -265683,7 +265683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -266017,8 +266017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -266783,7 +266783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -267117,8 +267117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -267883,7 +267883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -268217,8 +268217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -268983,7 +268983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -269317,8 +269317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -270083,7 +270083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -270417,8 +270417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -271183,7 +271183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -271517,8 +271517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -272283,7 +272283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -272617,8 +272617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -273383,7 +273383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -273717,8 +273717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -274483,7 +274483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -274817,8 +274817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -275583,7 +275583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -275917,8 +275917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -276683,7 +276683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -277017,8 +277017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -277783,7 +277783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -278117,8 +278117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -278883,7 +278883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -279217,8 +279217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -279983,7 +279983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -280317,8 +280317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -281083,7 +281083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -281417,8 +281417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -282183,7 +282183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -282517,8 +282517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -283283,7 +283283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -283617,8 +283617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -284383,7 +284383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -284717,8 +284717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -285483,7 +285483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -285817,8 +285817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -286583,7 +286583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -286917,8 +286917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -287683,7 +287683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -288017,8 +288017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -288783,7 +288783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -289117,8 +289117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -289883,7 +289883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -290217,8 +290217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -290983,7 +290983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -291317,8 +291317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -292083,7 +292083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -292417,8 +292417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -293183,7 +293183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -293517,8 +293517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -294283,7 +294283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -294617,8 +294617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -295383,7 +295383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -295717,8 +295717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -296483,7 +296483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -296817,8 +296817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -297583,7 +297583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -297917,8 +297917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -298683,7 +298683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -299017,8 +299017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -299783,7 +299783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -300117,8 +300117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -300883,7 +300883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -301217,8 +301217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -301983,7 +301983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -302317,8 +302317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -303083,7 +303083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -303417,8 +303417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -304183,7 +304183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -304517,8 +304517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -305283,7 +305283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -305617,8 +305617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -306383,7 +306383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -306717,8 +306717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -307483,7 +307483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -307817,8 +307817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -308583,7 +308583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -308917,8 +308917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -309683,7 +309683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -310017,8 +310017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -310783,7 +310783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -311117,8 +311117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -311883,7 +311883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -312217,8 +312217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -312983,7 +312983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -313317,8 +313317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -314083,7 +314083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -314417,8 +314417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -315183,7 +315183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -315517,8 +315517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -316283,7 +316283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -316617,8 +316617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -317383,7 +317383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -317717,8 +317717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -318483,7 +318483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -318817,8 +318817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -319583,7 +319583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -319917,8 +319917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -320683,7 +320683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -321017,8 +321017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -321783,7 +321783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -322117,8 +322117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -322883,7 +322883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -323217,8 +323217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -323983,7 +323983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -324317,8 +324317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -325083,7 +325083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -325417,8 +325417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -326183,7 +326183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -326517,8 +326517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -327283,7 +327283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -327617,8 +327617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -328383,7 +328383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -328717,8 +328717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -329483,7 +329483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -329817,8 +329817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -330583,7 +330583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -330917,8 +330917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -331683,7 +331683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -332017,8 +332017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -332783,7 +332783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -333117,8 +333117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -333883,7 +333883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -334217,8 +334217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -334983,7 +334983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -335317,8 +335317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -336083,7 +336083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -336417,8 +336417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -337183,7 +337183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -337517,8 +337517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -338283,7 +338283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -338617,8 +338617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -339383,7 +339383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -339717,8 +339717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -340483,7 +340483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -340817,8 +340817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -341583,7 +341583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -341917,8 +341917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -342683,7 +342683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -343017,8 +343017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -343783,7 +343783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -344117,8 +344117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -344883,7 +344883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -345217,8 +345217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -345983,7 +345983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -346317,8 +346317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -347083,7 +347083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -347417,8 +347417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -348183,7 +348183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -348517,8 +348517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -349283,7 +349283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -349617,8 +349617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -350383,7 +350383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -350717,8 +350717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -351483,7 +351483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -351817,8 +351817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -352583,7 +352583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -352917,8 +352917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -353683,7 +353683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -354017,8 +354017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -354783,7 +354783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -355117,8 +355117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -355883,7 +355883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -356217,8 +356217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -356983,7 +356983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -357317,8 +357317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -358083,7 +358083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -358417,8 +358417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -359183,7 +359183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -359517,8 +359517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -360283,7 +360283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -360617,8 +360617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -361383,7 +361383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -361717,8 +361717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -362483,7 +362483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -362817,8 +362817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -363583,7 +363583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -363917,8 +363917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -364683,7 +364683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -365017,8 +365017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -365783,7 +365783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -366117,8 +366117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -366883,7 +366883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -367217,8 +367217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -367983,7 +367983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -368317,8 +368317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -369083,7 +369083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -369417,8 +369417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -370183,7 +370183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -370517,8 +370517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -371283,7 +371283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -371617,8 +371617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -372383,7 +372383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -372717,8 +372717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -373483,7 +373483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -373817,8 +373817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -374583,7 +374583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -374917,8 +374917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -375683,7 +375683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -376017,8 +376017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -376783,7 +376783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -377117,8 +377117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -377883,7 +377883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -378217,8 +378217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -378983,7 +378983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -379317,8 +379317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -380083,7 +380083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -380417,8 +380417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -381183,7 +381183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -381517,8 +381517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -382283,7 +382283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -382617,8 +382617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -383383,7 +383383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -383717,8 +383717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -384483,7 +384483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -384817,8 +384817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -385583,7 +385583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -385917,8 +385917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -386683,7 +386683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -387017,8 +387017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -387783,7 +387783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -388117,8 +388117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -388883,7 +388883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -389217,8 +389217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -389983,7 +389983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -390317,8 +390317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -391083,7 +391083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -391417,8 +391417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -392183,7 +392183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -392517,8 +392517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -393283,7 +393283,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -393617,8 +393617,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -394383,7 +394383,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -394717,8 +394717,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -395483,7 +395483,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -395817,8 +395817,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -396583,7 +396583,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -396917,8 +396917,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -397683,7 +397683,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -398017,8 +398017,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -398783,7 +398783,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -399117,8 +399117,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -399883,7 +399883,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -400217,8 +400217,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -400983,7 +400983,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -401317,8 +401317,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -402083,7 +402083,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -402417,8 +402417,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
@@ -403183,7 +403183,7 @@ T1051,No,-,0
 T1055.002,No,-,0
 T1218.012,No,-,0
 T1586,No,-,0
-T1569.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/create_service_in_suspicious_file_path.yml,1
+T1569.001,No,-,0
 T1584.005,No,-,0
 T1059.008,No,-,0
 T1552.003,No,-,0
@@ -403517,8 +403517,8 @@ T1500,No,-,0
 T1565.002,No,-,0
 T1003.008,No,-,0
 T1543.001,No,-,0
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,7
-T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,7
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6
+T1569,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/windows_connhost_exe_force_flag.yml,6
 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cmd_echo_pipe___escalation.yml,6
diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json
index 6ddac4d307..ce7a2dcd3e 100644
--- a/docs/mitre-map/coverage.json
+++ b/docs/mitre-map/coverage.json
@@ -702,11 +702,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -1084,7 +1080,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -2014,11 +2010,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -2396,7 +2388,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -3326,11 +3318,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -3708,7 +3696,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -4638,11 +4626,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -5020,7 +5004,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -5950,11 +5934,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -6332,7 +6312,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -7262,11 +7242,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -7644,7 +7620,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -8574,11 +8550,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -8956,7 +8928,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -9886,11 +9858,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -10268,7 +10236,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -11198,11 +11166,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -11580,7 +11544,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -12510,11 +12474,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -12892,7 +12852,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -13822,11 +13782,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -14204,7 +14160,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -15134,11 +15090,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -15516,7 +15468,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -16446,11 +16398,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -16828,7 +16776,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -17758,11 +17706,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -18140,7 +18084,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -19070,11 +19014,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -19452,7 +19392,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -20382,11 +20322,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -20764,7 +20700,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -21694,11 +21630,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -22076,7 +22008,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -23006,11 +22938,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -23388,7 +23316,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -24318,11 +24246,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -24700,7 +24624,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -25630,11 +25554,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -26012,7 +25932,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -26942,11 +26862,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -27324,7 +27240,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -28254,11 +28170,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -28636,7 +28548,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -29566,11 +29478,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -29948,7 +29856,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -30878,11 +30786,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -31260,7 +31164,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -32190,11 +32094,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -32572,7 +32472,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -33502,11 +33402,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -33884,7 +33780,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -34814,11 +34710,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -35196,7 +35088,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -36126,11 +36018,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -36508,7 +36396,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -37438,11 +37326,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -37820,7 +37704,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -38750,11 +38634,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -39132,7 +39012,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -40062,11 +39942,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -40444,7 +40320,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -41374,11 +41250,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -41756,7 +41628,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -42686,11 +42558,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -43068,7 +42936,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -43998,11 +43866,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -44380,7 +44244,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -45310,11 +45174,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -45692,7 +45552,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -46622,11 +46482,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -47004,7 +46860,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -47934,11 +47790,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -48316,7 +48168,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -49246,11 +49098,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -49628,7 +49476,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -50558,11 +50406,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -50940,7 +50784,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -51870,11 +51714,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -52252,7 +52092,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -53182,11 +53022,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -53564,7 +53400,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -54494,11 +54330,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -54876,7 +54708,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -55806,11 +55638,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -56188,7 +56016,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -57118,11 +56946,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -57500,7 +57324,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -58430,11 +58254,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -58812,7 +58632,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -59742,11 +59562,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -60124,7 +59940,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -61054,11 +60870,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -61436,7 +61248,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -62366,11 +62178,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -62748,7 +62556,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -63678,11 +63486,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -64060,7 +63864,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -64990,11 +64794,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -65372,7 +65172,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -66302,11 +66102,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -66684,7 +66480,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -67614,11 +67410,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -67996,7 +67788,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -68926,11 +68718,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -69308,7 +69096,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -70238,11 +70026,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -70620,7 +70404,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -71550,11 +71334,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -71932,7 +71712,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -72862,11 +72642,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -73244,7 +73020,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -74174,11 +73950,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -74556,7 +74328,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -75486,11 +75258,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -75868,7 +75636,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -76798,11 +76566,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -77180,7 +76944,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -78110,11 +77874,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -78492,7 +78252,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -79422,11 +79182,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -79804,7 +79560,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -80734,11 +80490,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -81116,7 +80868,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -82046,11 +81798,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -82428,7 +82176,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -83358,11 +83106,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -83740,7 +83484,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -84670,11 +84414,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -85052,7 +84792,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -85982,11 +85722,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -86364,7 +86100,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -87294,11 +87030,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -87676,7 +87408,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -88606,11 +88338,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -88988,7 +88716,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -89918,11 +89646,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -90300,7 +90024,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -91230,11 +90954,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -91612,7 +91332,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -92542,11 +92262,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -92924,7 +92640,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -93854,11 +93570,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -94236,7 +93948,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -95166,11 +94878,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -95548,7 +95256,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -96478,11 +96186,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -96860,7 +96564,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -97790,11 +97494,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -98172,7 +97872,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -99102,11 +98802,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -99484,7 +99180,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -100414,11 +100110,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -100796,7 +100488,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -101726,11 +101418,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -102108,7 +101796,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -103038,11 +102726,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -103420,7 +103104,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -104350,11 +104034,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -104732,7 +104412,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -105662,11 +105342,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -106044,7 +105720,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -106974,11 +106650,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -107356,7 +107028,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -108286,11 +107958,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -108668,7 +108336,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -109598,11 +109266,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -109980,7 +109644,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -110910,11 +110574,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -111292,7 +110952,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -112222,11 +111882,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -112604,7 +112260,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -113534,11 +113190,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -113916,7 +113568,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -114846,11 +114498,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -115228,7 +114876,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -116158,11 +115806,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -116540,7 +116184,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -117470,11 +117114,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -117852,7 +117492,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -118782,11 +118422,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -119164,7 +118800,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -120094,11 +119730,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -120476,7 +120108,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -121406,11 +121038,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -121788,7 +121416,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -122718,11 +122346,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -123100,7 +122724,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -124030,11 +123654,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -124412,7 +124032,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -125342,11 +124962,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -125724,7 +125340,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -126654,11 +126270,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -127036,7 +126648,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -127966,11 +127578,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -128348,7 +127956,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -129278,11 +128886,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -129660,7 +129264,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -130590,11 +130194,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -130972,7 +130572,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -131902,11 +131502,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -132284,7 +131880,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -133214,11 +132810,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -133596,7 +133188,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -134526,11 +134118,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -134908,7 +134496,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -135838,11 +135426,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -136220,7 +135804,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -137150,11 +136734,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -137532,7 +137112,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -138462,11 +138042,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -138844,7 +138420,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -139774,11 +139350,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -140156,7 +139728,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -141086,11 +140658,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -141468,7 +141036,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -142398,11 +141966,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -142780,7 +142344,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -143710,11 +143274,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -144092,7 +143652,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -145022,11 +144582,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -145404,7 +144960,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -146334,11 +145890,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -146716,7 +146268,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -147646,11 +147198,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -148028,7 +147576,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -148958,11 +148506,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -149340,7 +148884,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -150270,11 +149814,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -150652,7 +150192,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -151582,11 +151122,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -151964,7 +151500,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -152894,11 +152430,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -153276,7 +152808,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -154206,11 +153738,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -154588,7 +154116,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -155518,11 +155046,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -155900,7 +155424,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -156830,11 +156354,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -157212,7 +156732,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -158142,11 +157662,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -158524,7 +158040,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -159454,11 +158970,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -159836,7 +159348,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -160766,11 +160278,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -161148,7 +160656,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -162078,11 +161586,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -162460,7 +161964,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -163390,11 +162894,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -163772,7 +163272,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -164702,11 +164202,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -165084,7 +164580,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -166014,11 +165510,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -166396,7 +165888,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -167326,11 +166818,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -167708,7 +167196,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -168638,11 +168126,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -169020,7 +168504,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -169950,11 +169434,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -170332,7 +169812,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -171262,11 +170742,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -171644,7 +171120,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -172574,11 +172050,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -172956,7 +172428,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -173886,11 +173358,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -174268,7 +173736,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -175198,11 +174666,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -175580,7 +175044,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -176510,11 +175974,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -176892,7 +176352,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -177822,11 +177282,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -178204,7 +177660,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -179134,11 +178590,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -179516,7 +178968,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -180446,11 +179898,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -180828,7 +180276,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -181758,11 +181206,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -182140,7 +181584,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -183070,11 +182514,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -183452,7 +182892,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -184382,11 +183822,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -184764,7 +184200,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -185694,11 +185130,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -186076,7 +185508,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -187006,11 +186438,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -187388,7 +186816,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -188318,11 +187746,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -188700,7 +188124,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -189630,11 +189054,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -190012,7 +189432,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -190942,11 +190362,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -191324,7 +190740,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -192254,11 +191670,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -192636,7 +192048,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -193566,11 +192978,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -193948,7 +193356,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -194878,11 +194286,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -195260,7 +194664,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -196190,11 +195594,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -196572,7 +195972,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -197502,11 +196902,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -197884,7 +197280,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -198814,11 +198210,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -199196,7 +198588,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -200126,11 +199518,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -200508,7 +199896,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -201438,11 +200826,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -201820,7 +201204,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -202750,11 +202134,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -203132,7 +202512,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -204062,11 +203442,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -204444,7 +203820,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -205374,11 +204750,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -205756,7 +205128,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -206686,11 +206058,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -207068,7 +206436,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -207998,11 +207366,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -208380,7 +207744,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -209310,11 +208674,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -209692,7 +209052,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -210622,11 +209982,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -211004,7 +210360,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -211934,11 +211290,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -212316,7 +211668,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -213246,11 +212598,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -213628,7 +212976,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -214558,11 +213906,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -214940,7 +214284,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -215870,11 +215214,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -216252,7 +215592,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -217182,11 +216522,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -217564,7 +216900,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -218494,11 +217830,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -218876,7 +218208,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -219806,11 +219138,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -220188,7 +219516,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -221118,11 +220446,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -221500,7 +220824,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -222430,11 +221754,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -222812,7 +222132,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -223742,11 +223062,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -224124,7 +223440,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -225054,11 +224370,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -225436,7 +224748,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -226366,11 +225678,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -226748,7 +226056,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -227678,11 +226986,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -228060,7 +227364,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -228990,11 +228294,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -229372,7 +228672,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -230302,11 +229602,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -230684,7 +229980,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -231614,11 +230910,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -231996,7 +231288,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -232926,11 +232218,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -233308,7 +232596,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -234238,11 +233526,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -234620,7 +233904,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -235550,11 +234834,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -235932,7 +235212,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -236862,11 +236142,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -237244,7 +236520,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -238174,11 +237450,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -238556,7 +237828,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -239486,11 +238758,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -239868,7 +239136,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -240798,11 +240066,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -241180,7 +240444,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -242110,11 +241374,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -242492,7 +241752,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -243422,11 +242682,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -243804,7 +243060,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -244734,11 +243990,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -245116,7 +244368,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -246046,11 +245298,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -246428,7 +245676,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -247358,11 +246606,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -247740,7 +246984,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -248670,11 +247914,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -249052,7 +248292,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -249982,11 +249222,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -250364,7 +249600,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -251294,11 +250530,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -251676,7 +250908,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -252606,11 +251838,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -252988,7 +252216,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -253918,11 +253146,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -254300,7 +253524,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -255230,11 +254454,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -255612,7 +254832,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -256542,11 +255762,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -256924,7 +256140,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -257854,11 +257070,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -258236,7 +257448,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -259166,11 +258378,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -259548,7 +258756,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -260478,11 +259686,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -260860,7 +260064,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -261790,11 +260994,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -262172,7 +261372,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -263102,11 +262302,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -263484,7 +262680,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -264414,11 +263610,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -264796,7 +263988,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -265726,11 +264918,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -266108,7 +265296,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -267038,11 +266226,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -267420,7 +266604,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -268350,11 +267534,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -268732,7 +267912,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -269662,11 +268842,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -270044,7 +269220,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -270974,11 +270150,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -271356,7 +270528,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -272286,11 +271458,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -272668,7 +271836,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -273598,11 +272766,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -273980,7 +273144,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -274910,11 +274074,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -275292,7 +274452,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -276222,11 +275382,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -276604,7 +275760,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -277534,11 +276690,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -277916,7 +277068,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -278846,11 +277998,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -279228,7 +278376,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -280158,11 +279306,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -280540,7 +279684,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -281470,11 +280614,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -281852,7 +280992,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -282782,11 +281922,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -283164,7 +282300,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -284094,11 +283230,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -284476,7 +283608,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -285406,11 +284538,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -285788,7 +284916,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -286718,11 +285846,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -287100,7 +286224,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -288030,11 +287154,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -288412,7 +287532,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -289342,11 +288462,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -289724,7 +288840,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -290654,11 +289770,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -291036,7 +290148,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -291966,11 +291078,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -292348,7 +291456,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -293278,11 +292386,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -293660,7 +292764,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -294590,11 +293694,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -294972,7 +294072,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -295902,11 +295002,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -296284,7 +295380,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -297214,11 +296310,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -297596,7 +296688,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -298526,11 +297618,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -298908,7 +297996,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -299838,11 +298926,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -300220,7 +299304,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -301150,11 +300234,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -301532,7 +300612,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -302462,11 +301542,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -302844,7 +301920,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -303774,11 +302850,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -304156,7 +303228,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -305086,11 +304158,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -305468,7 +304536,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -306398,11 +305466,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -306780,7 +305844,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -307710,11 +306774,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -308092,7 +307152,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -309022,11 +308082,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -309404,7 +308460,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -310334,11 +309390,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -310716,7 +309768,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -311646,11 +310698,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -312028,7 +311076,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -312958,11 +312006,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -313340,7 +312384,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -314270,11 +313314,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -314652,7 +313692,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -315582,11 +314622,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -315964,7 +315000,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -316894,11 +315930,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -317276,7 +316308,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -318206,11 +317238,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -318588,7 +317616,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -319518,11 +318546,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -319900,7 +318924,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -320830,11 +319854,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -321212,7 +320232,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -322142,11 +321162,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -322524,7 +321540,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -323454,11 +322470,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -323836,7 +322848,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -324766,11 +323778,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -325148,7 +324156,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -326078,11 +325086,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -326460,7 +325464,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -327390,11 +326394,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -327772,7 +326772,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -328702,11 +327702,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -329084,7 +328080,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -330014,11 +329010,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -330396,7 +329388,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -331326,11 +330318,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -331708,7 +330696,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -332638,11 +331626,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -333020,7 +332004,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -333950,11 +332934,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -334332,7 +333312,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -335262,11 +334242,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -335644,7 +334620,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -336574,11 +335550,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -336956,7 +335928,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -337886,11 +336858,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -338268,7 +337236,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -339198,11 +338166,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -339580,7 +338544,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -340510,11 +339474,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -340892,7 +339852,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -341822,11 +340782,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -342204,7 +341160,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -343134,11 +342090,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -343516,7 +342468,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -344446,11 +343398,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -344828,7 +343776,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -345758,11 +344706,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -346140,7 +345084,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -347070,11 +346014,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -347452,7 +346392,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -348382,11 +347322,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -348764,7 +347700,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -349694,11 +348630,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -350076,7 +349008,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -351006,11 +349938,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -351388,7 +350316,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -352318,11 +351246,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -352700,7 +351624,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -353630,11 +352554,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -354012,7 +352932,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -354942,11 +353862,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -355324,7 +354240,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -356254,11 +355170,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -356636,7 +355548,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -357566,11 +356478,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -357948,7 +356856,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -358878,11 +357786,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -359260,7 +358164,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -360190,11 +359094,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -360572,7 +359472,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -361502,11 +360402,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -361884,7 +360780,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -362814,11 +361710,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -363196,7 +362088,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -364126,11 +363018,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -364508,7 +363396,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -365438,11 +364326,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -365820,7 +364704,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -366750,11 +365634,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -367132,7 +366012,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -368062,11 +366942,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -368444,7 +367320,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -369374,11 +368250,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -369756,7 +368628,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -370686,11 +369558,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -371068,7 +369936,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -371998,11 +370866,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -372380,7 +371244,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -373310,11 +372174,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -373692,7 +372552,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -374622,11 +373482,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -375004,7 +373860,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -375934,11 +374790,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -376316,7 +375168,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -377246,11 +376098,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -377628,7 +376476,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -378558,11 +377406,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -378940,7 +377784,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -379870,11 +378714,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -380252,7 +379092,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -381182,11 +380022,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -381564,7 +380400,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -382494,11 +381330,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -382876,7 +381708,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -383806,11 +382638,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -384188,7 +383016,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -385118,11 +383946,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -385500,7 +384324,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -386430,11 +385254,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -386812,7 +385632,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -387742,11 +386562,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -388124,7 +386940,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -389054,11 +387870,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -389436,7 +388248,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -390366,11 +389178,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -390748,7 +389556,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -391678,11 +390486,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -392060,7 +390864,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -392990,11 +391794,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -393372,7 +392172,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -394302,11 +393102,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -394684,7 +393480,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -395614,11 +394410,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -395996,7 +394788,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -396926,11 +395718,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -397308,7 +396096,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -398238,11 +397026,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -398620,7 +397404,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -399550,11 +398334,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -399932,7 +398712,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -400862,11 +399642,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -401244,7 +400020,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -402174,11 +400950,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -402556,7 +401328,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -403486,11 +402258,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -403868,7 +402636,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -404798,11 +403566,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -405180,7 +403944,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -406110,11 +404874,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -406492,7 +405252,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -407422,11 +406182,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -407804,7 +406560,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -408734,11 +407490,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -409116,7 +407868,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -410046,11 +408798,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -410428,7 +409176,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -411358,11 +410106,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -411740,7 +410484,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -412670,11 +411414,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -413052,7 +411792,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -413982,11 +412722,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -414364,7 +413100,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -415294,11 +414030,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -415676,7 +414408,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -416606,11 +415338,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -416988,7 +415716,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -417918,11 +416646,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -418300,7 +417024,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -419230,11 +417954,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -419612,7 +418332,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -420542,11 +419262,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -420924,7 +419640,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -421854,11 +420570,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -422236,7 +420948,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -423166,11 +421878,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -423548,7 +422256,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -424478,11 +423186,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -424860,7 +423564,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -425790,11 +424494,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -426172,7 +424872,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -427102,11 +425802,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -427484,7 +426180,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -428414,11 +427110,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -428796,7 +427488,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -429726,11 +428418,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -430108,7 +428796,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -431038,11 +429726,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -431420,7 +430104,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -432350,11 +431034,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -432732,7 +431412,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -433662,11 +432342,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -434044,7 +432720,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -434974,11 +433650,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -435356,7 +434028,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -436286,11 +434958,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -436668,7 +435336,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -437598,11 +436266,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -437980,7 +436644,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -438910,11 +437574,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -439292,7 +437952,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -440222,11 +438882,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -440604,7 +439260,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -441534,11 +440190,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -441916,7 +440568,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -442846,11 +441498,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -443228,7 +441876,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -444158,11 +442806,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -444540,7 +443184,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -445470,11 +444114,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -445852,7 +444492,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -446782,11 +445422,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -447164,7 +445800,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -448094,11 +446730,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -448476,7 +447108,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -449406,11 +448038,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -449788,7 +448416,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -450718,11 +449346,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -451100,7 +449724,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -452030,11 +450654,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -452412,7 +451032,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -453342,11 +451962,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -453724,7 +452340,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -454654,11 +453270,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -455036,7 +453648,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -455966,11 +454578,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -456348,7 +454956,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -457278,11 +455886,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -457660,7 +456264,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -458590,11 +457194,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -458972,7 +457572,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -459902,11 +458502,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -460284,7 +458880,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -461214,11 +459810,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -461596,7 +460188,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -462526,11 +461118,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -462908,7 +461496,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -463838,11 +462426,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -464220,7 +462804,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -465150,11 +463734,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -465532,7 +464112,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -466462,11 +465042,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -466844,7 +465420,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -467774,11 +466350,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -468156,7 +466728,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -469086,11 +467658,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -469468,7 +468036,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -470398,11 +468966,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -470780,7 +469344,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -471710,11 +470274,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -472092,7 +470652,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -473022,11 +471582,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -473404,7 +471960,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -474334,11 +472890,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -474716,7 +473268,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -475646,11 +474198,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -476028,7 +474576,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -476958,11 +475506,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -477340,7 +475884,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -478270,11 +476814,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -478652,7 +477192,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -479582,11 +478122,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -479964,7 +478500,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
@@ -480894,11 +479430,7 @@
         {},
         {},
         {},
-        {
-            "techniqueID": "T1569.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/create_service_in_suspicious_file_path.yml"
-        },
+        {},
         {},
         {},
         {},
@@ -481276,7 +479808,7 @@
         {},
         {
             "techniqueID": "T1569",
-            "score": 7,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml"
         },
         {
diff --git a/docs/stories.md b/docs/stories.md
index a71b691651..aa39f28fe9 100644
--- a/docs/stories.md
+++ b/docs/stories.md
@@ -4164,7 +4164,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint
-- **ATT&CK**: [T1003.002](https://attack.mitre.org/techniques/T1003.002/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1486](https://attack.mitre.org/techniques/T1486/), [T1489](https://attack.mitre.org/techniques/T1489/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1543](https://attack.mitre.org/techniques/T1543/), [T1569.001](https://attack.mitre.org/techniques/T1569.001/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/)
+- **ATT&CK**: [T1003.002](https://attack.mitre.org/techniques/T1003.002/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1486](https://attack.mitre.org/techniques/T1486/), [T1489](https://attack.mitre.org/techniques/T1489/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1543](https://attack.mitre.org/techniques/T1543/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/)
 - **Last Updated**: 2021-03-17
 
 

@@ -4212,7 +4212,6 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | T1204 | User Execution | Execution |
 | T1543 | Create or Modify System Process | Persistence, Privilege Escalation |
 | T1485 | Data Destruction | Impact |
-| T1569.001 | Launchctl | Execution |
 | T1569.002 | Service Execution | Execution |
 | T1490 | Inhibit System Recovery | Impact |
 | T1486 | Data Encrypted for Impact | Impact |
@@ -5267,6 +5266,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * Lateral Movement
 
+* Reconnaissance
+
 
 #### Reference
 
diff --git a/docs/stories.wiki b/docs/stories.wiki
index 34b6c367d2..be14f3581a 100644
--- a/docs/stories.wiki
+++ b/docs/stories.wiki
@@ -5470,7 +5470,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1569.001/ T1569.001], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
 * '''Last Updated''': 2021-03-17
 
 

@@ -5530,10 +5530,6 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | Data Destruction
 | Impact
 |-
-| T1569.001
-| Launchctl
-| Execution
-|-
 | T1569.002
 | Service Execution
 | Execution
@@ -7088,6 +7084,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * Lateral Movement
 
+* Reconnaissance
+
 
 ====Reference====
 
@@ -7787,7 +7785,7 @@ In March of 2016, adversaries were seen using JexBoss--an open-source utility us
 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content
-# On Date: 2021-07-20 17:40:49.290678 UTC
+# On Date: 2021-07-20 21:03:23.148505 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############